paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 87466
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 01:52:25 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JVTV25E8BH3PDB1GEHVDQ1FN

Redirect headers

accept-ranges: bytes
age: 87465
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1666
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 01:52:25 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JVTV25BBENHJNGWN2T1SWGVR

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 406ms
255ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d08ff5524fda53a59b6babe2249e4e93c3b6b3c8de0ca8ace5cb76f1488a8c78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-ray: 9438ac911a8a865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:25 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 90ms
89ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 81949
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JVTV25HG1JE7NCQJQZN1MSHP
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 178ms
177ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 80126
accept-ranges: bytes
content-length: 1167
x-nf-request-id: 01JVTV25HGKGYKQ4B97561WQSY
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 89ms
89ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 91214
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JVTV25HGRGQWP5H5ZRQH8HGS
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 171ms
171ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 89030
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JVTV25HG6PDRMHQQEMX6JF3X
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 90ms
89ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 81948
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JVTV25Q0E5AJ7EF98786303K
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 91ms
90ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 72934
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JVTV25Q5W8H73CXWBE4P56M4
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 01:52:25 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 60ms
60ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0c65bb8d7c27819d2534ec053cd03aa74737dae4b5ba79e04d10e66161a021b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9438ac914aa1865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:25 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 370 KB
125 KB 508ms
216ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

33b43ad8707f55b8c1f12bf6c6d86c47ab759cdafc82064c17fc504c2d1fb2f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 01:52:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 127201
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 j406wv9b45h_3.v2.js Show response
faucetfoot.com/assets/js/ 68 KB
25 KB 622ms
232ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

a8108560ee8a1b431e90d0a86d198a9bfc501f4733242d95091f62db8cfa28b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"378ad58ddf0fae36a5375d6f94db62c7db53cfbdaa51954857e57253a0051a3a"
via: fen-hoothoot-asia-east1-p67b.gce-asia-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 1042ms
402ms Script
text/javascript 142.251.133.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.133.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4f44394ee9d00dccfabcc064cb0315e32c1631a4fe716736383d28d47d602d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 596 / 20230 / m202505190101 / config-hash: 2851738409813473497
x-content-type-options: nosniff
expires: Thu, 22 May 2025 01:52:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34137
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 71ms
71ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 895
cf-ray: 9438ac92cb5d865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 411 B
387 B 57ms
56ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cefb14adf44d7be710ac086bd9956380a96dc8220bcca80af1144e3c5312877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"d8cc960b7ac2417b4c245b40d1501e32"
age: 1426
cf-ray: 9438ac92cb60865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
413 B 120ms
59ms Script
application/javascript 104.18.25.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.25.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15244136358cd97b25480f6361ddd6c64799c471daf8cbfdd9f7e9030fe73eb6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 9438ac932b208646-PER
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.688a9519bf222c577628.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 59ms
59ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adb9d1101e62377f34b6db7996ffc4eb80f8968ae7063b988ba2d85ee2ec2a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"2014aef5a932767aee99c8c09ee9aea2"
age: 1426
cf-ray: 9438ac932b94865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.de88eb0a31bf4b182063.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 519 KB
157 KB 107ms
107ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6395a8c7b596927e52b00afe7511a91cf9043ae95d61763316ab139974b1bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"81a507d88d3b44587deef78119119de8"
age: 1378
cf-ray: 9438ac932b95865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 559 B
444 B 63ms
58ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 1064
cf-ray: 9438ac956d24865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 4642 503 B
427 B 215ms
58ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 1491
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9438ac966b4e8aca-PER
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 01:52:26 GMT
hw-country-code: AU
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 4EEC 503 B
0 211ms
211ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 1491
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9438ac966b4e8aca-PER
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 01:52:26 GMT
hw-country-code: AU
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 TIER_1 Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/21/desktop/Chrome/ 584 B
920 B 335ms
95ms XHR
application/json 2600:9000:2212:bc00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/21/desktop/Chrome/TIER_1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2212:bc00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 01729b7818fe886d71aa576a012cbabfd3c9f24350e737f0805d8daa88cad885

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3137
via: 1.1 a6b70b5c031397eba9646ba0eedbdb86.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: lwb8EAu7-lRVGwSDyr4ABsXfm9YNdlmN5r5nPeIPLn2uBkrSX9OMyA==
date: Thu, 22 May 2025 01:00:09 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 175ms
61ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e28a9ac4afbb61e4bb6cc21c8f5772bcffc6e87cbf7f3af3522be2dd76b3010d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "a7eb27bf47173c9b4e82d2dcc163412f"
via: 1.1 google
cf-ray: 9438ac96392a864c-PER
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39584
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/javascript
last-modified: Thu, 22 May 2025 00:52:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 340ms
103ms Script
application/javascript 108.158.21.92
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 3310
via: 1.1 4ab519b4cd27a1b8a4b258d7f39bbc7e.cloudfront.net (CloudFront), 1.1 a97b28e298ec5907aa1d86d22bc232a0.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: ifdjMt4nu-qTaCoAU_YQmH7g_Ajjxv4eHny3Lyc6FYRkuCuvZ55Gpg==
date: Thu, 22 May 2025 00:57:17 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: SYD62-P2, SYD62-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
583 B 158ms
47ms Image
image/gif 2606:50c0:8002::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 184de9ef4071289febf553f8fb0e17971d0e8d55
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 7C81:173C2E:5848:15544:680FA311
expires: Thu, 22 May 2025 01:57:26 GMT
x-cache: HIT
date: Thu, 22 May 2025 01:52:26 GMT
content-type: image/gif
x-served-by: cache-per12624-PER
x-cache-hits: 9
source-age: 41
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1747878747.599372,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 338ms
101ms Script
text/javascript 108.158.32.17
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.32.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-32-17.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 25938
via: 1.1 99d08a30eb552b5891a16e6c0ba4a4ea.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zKSbj-_VbjLhLGyQcoS_8Rd3RNTF52bk1vJTMygLzNoLRPXLlaEInA==
date: Wed, 21 May 2025 18:40:09 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: SYD3-P2
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
111 KB 216ms
215ms Script
application/javascript 2404:6800:4006:80a::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55k1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:80a::2008 Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5f08a6891ed6955baf4c593936fdd76d32f8628eab511a0f68950f954cfd8c1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 01:52:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 113225
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 1119ms
385ms Fetch
text/plain 2800:3f0:4005:411::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55k1v9101576445za200&_p=1747878745611&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=1917009361.1747878747&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747878746&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1948
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4005:411::200e , Argentina, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 485ms
297ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 170ms
58ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 974367
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 01:52:26 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIteM8kBiwO4-XkKx_JoJOyot5g37ar484KxV7NtbEDAX8_KDlpVMrkQDICa68Gumc-W-uehp_k
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9438ac97b88287b8-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 980ms
338ms Image
image/x-icon 142.250.218.134
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.218.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

rio06s14-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 27532
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 22 May 2025 18:13:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:13:35 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
547 B 166ms
56ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.004255280327160937
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 974367
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 01:52:26 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIteM8kBiwO4-XkKx_JoJOyot5g37ar484KxV7NtbEDAX8_KDlpVMrkQDICa68Gumc-W-uehp_k
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9438ac97b88187b8-PER
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 4642 17 KB
7 KB 60ms
58ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1372
cf-ray: 9438ac972bcc8aca-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 4EEC 17 KB
0 63ms
62ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1372
cf-ray: 9438ac972bcc8aca-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 745ms
244ms Image
image/gif 2600:9000:25f0:3400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=7435261_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25f0:3400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 73729
x-cache: Hit from cloudfront
x-amz-cf-id: f5f-Dn2K9dTRdReMRT6BrPVeKpujytEiHbKLroPPAwIIIWx3efS49A==
date: Wed, 21 May 2025 05:23:39 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 35e7912b77137b5fd670abbaffd598de.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: SFO53-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET 67354fb7-545c-42e1-8fc1-15392c96fadc
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 427ms
141ms Preflight
application/json 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 01:52:26 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 214732
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 128ms
64ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 56273
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Tue, 20 May 2025 22:29:54 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: AU
cache-control: public, max-age=86400
cf-ray: 9438ac989bce7382-PER
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
1 KB 59ms
58ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: AU
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 1372
cf-ray: 9438ac983ef2865f-PER
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:26 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:27 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 954ms
317ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: sdgwsq.partysballoons.com.au
URL: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 276e174d8a35af0046ceaf29e8cd85960a7133428a48e65e23ea56d00dfc0618

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 517ms
223ms Script
text/javascript 2404:6800:4006:804::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4006:804::200a Sydney, Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8162be16050698296a8a42765b720aa888bc29ec4e6d13b243783c89f577ff8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16518374809855574708
x-content-type-options: nosniff
expires: Thu, 22 May 2025 01:52:27 GMT
alt-svc: h3=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145165
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 1012ms
336ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-4-88-156.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 01:52:26 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
852 B 306ms
109ms Fetch
application/json 13.213.163.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.213.163.72 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-213-163-72.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2f4497f0c1e252a3612066e2c1323b67869f125b605297f8ec4ae26c5b2f34a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 0
364 B 736ms
239ms Fetch 35.82.46.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.82.46.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-46-239.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 22 May 2025 01:52:27 GMT
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 888 B
1 KB 418ms
240ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 51143740928917d0ff535f8643c9189b1257ceab582db6b413a2dbbf157d9d1d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 888
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: origin

GET
H2 204 any Show response
idx.liadm.com/idex/did-0046/ 0
365 B 915ms
303ms Fetch 52.4.88.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jvtv26rwjaxcxkavk1e75p81&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.4.88.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=3599, private
trace-id: a80fe13e081f14f3
request-time: 1
access-control-allow-credentials: true
expires: Thu, 22 May 2025 02:52:27 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:27 GMT
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=BUWU8Hx4Q01JZ3lkRnk0dURtRklINjRMK3BmM1FwTWx1U1RIckxid2Z2ckxkLzYzc2dINFVCWHFBOVpETFlwNmRUMjVXTjl4UGV3SDdjNWtUbmxQKy8xRjVHdmx6N2ZxR3ZySzNYaTJzcUVBY3g3dkJkQzhEdk5DcUtRMV...

370 B
937 B

426ms
144ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=BUWU8Hx4Q01JZ3lkRnk0dURtRklINjRMK3BmM1FwTWx1U1RIckxid2Z2ckxkLzYzc2dINFVCWHFBOVpETFlwNmRUMjVXTjl4UGV3SDdjNWtUbmxQKy8xRjVHdmx6N2ZxR3ZySzNYaTJzcUVBY3g3dkJkQzhEdk5DcUtRMVMwd2g5OGx0NGZpRHM4UkkwS2lRMHk4TVZVOTFsaE1DMVlPMWpMU05VMXFVR2NLL2dTSktaTUpiL3JTNG1TN0FSOHJMRm9jZ2FiQ2tkNk5aeWw0bjlzY3lHNitLTzNUeVlyVXFkcHp1QUIwMktkZUcydWpzZU1zWVRZbWtxaFVBR1Z3UDZDYlpxfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

a714901192ef8db77d9db9675e452f3f9ad55947a1ef7c6ec7cbd22efb3e0117

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 539691
expires: 0
access-control-allow-origin: null
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=BUWU8Hx4Q01JZ3lkRnk0dURtRklINjRMK3BmM1FwTWx1U1RIckxid2Z2ckxkLzYzc2dINFVCWHFBOVpETFlwNmRUMjVXTjl4UGV3SDdjNWtUbmxQKy8xRjVHdmx6N2ZxR3ZySzNYaTJzcUVBY3g3dkJkQzhEdk5DcUtRMVMwd2g5OGx0NGZpRHM4UkkwS2lRMHk4TVZVOTFsaE1DMVlPMWpMU05VMXFVR2NLL2dTSktaTUpiL3JTNG1TN0FSOHJMRm9jZ2FiQ2tkNk5aeWw0bjlzY3lHNitLTzNUeVlyVXFkcHp1QUIwMktkZUcydWpzZU1zWVRZbWtxaFVBR1Z3UDZDYlpxfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 243409
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 01:52:27 GMT
server: Kestrel

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822

1 KB
1 KB

94ms
93ms

Script
application/javascript

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: f6a35ddc1ed3c2b34492d36a384e6494b627319c84c6e8f5eca7f19e837bb5dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1130
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:27 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:27 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 312ms
110ms XHR
application/json 18.139.146.33
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.139.146.33 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-139-146-33.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 32111c228173b745f603eb8ddd558f3748de03b4e6a909432076d2e25d4e529b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 286ms
95ms XHR
application/javascript 108.158.21.92
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 14610
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: lqk1p6EpCkKyKEgyjjJlrpR6LU0RQj7O4D6_xEreRRxZmNNQtCt5WA==
date: Wed, 21 May 2025 22:36:05 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 774e46f6c14ff2c856f5733bff7d936e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: SYD62-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 294ms
94ms Script
application/javascript 108.158.32.16
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.32.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-32-16.syd3.r.cloudfront.net
Software: CloudFront /
Resource Hash: ab6d8f57879cd6d3aab93562880a346c4c624f60538d9eeb733c81a1a9dec964

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1566
via: 1.1 f5bc0d54a76b57b6f435f98d3e741ea4.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: ohi51AX6kiTAnICYMuW90Xs_PSAJpM6Q4T1_fmBATxjLV7SC78RqxA==
date: Thu, 22 May 2025 01:26:21 GMT
content-type: application/javascript
x-amz-cf-pop: SYD3-P2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 96ms
96ms XHR
application/json 108.158.21.92
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.21.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-21-92.syd62.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 21137
access-control-allow-credentials: true
via: 1.1 a97b28e298ec5907aa1d86d22bc232a0.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: cqz6oPBnjhBSlaL6oh4Rr_Zv9WF8Y6ntrYGja5qTWSjajdMtBOXf-Q==
date: Wed, 21 May 2025 20:00:10 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD62-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 241 B
536 B 645ms
450ms Fetch
application/json 13.35.142.165
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&pid=cKareAsQbT1Zf&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=42590cde-2800-4fc4-ad4c-e2bb9949be2f&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.142.165 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-142-165.syd1.r.cloudfront.net
Software: Server /
Resource Hash: 94c87f3387d90fd01da4d18c2f9140a48b4f695a3eabe1260ff757532d69b48e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 7c4c2286abc7fc5145c880b21a28bb46.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 206
x-amz-cf-id: HJj6brTmhnQJM1TjbNXOLgp6iAzD_c8GuaFOrjicVF7YfeuMNe4rjw==
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: SYD1-C1
server: Server

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 9B3C 2 KB
1 KB 292ms
97ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=43218
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 22 May 2025 01:52:27 GMT
expires: Thu, 22 May 2025 13:52:45 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 84BD 1 KB
2 KB 315ms
86ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 01:06:09 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2Vwq4Hd1Jj90U_9yMG5YsxlzZtlErWfxgku4Ucec1D5zFqkYKaDynXvoiCXCK3IGiwLgI

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 370ms
302ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c923f7bc0f474969a11826bc1dfa610d35f08955bd55c15e7ff955b3e5cae03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878747&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=iDNw6vE3kbwHQ5l9ZpQLRzZ%2B%2BxZBfAhbxT5aqPZ%2BiB4%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878747&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=iDNw6vE3kbwHQ5l9ZpQLRzZ%2B%2BxZBfAhbxT5aqPZ%2BiB4%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9438ac99d898865b-PER
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 54 KB
14 KB 653ms
587ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ba861a9d5d0a16d66bb5301c527511e4720b770738b689519a3e6ee118d55bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878747&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=iDNw6vE3kbwHQ5l9ZpQLRzZ%2B%2BxZBfAhbxT5aqPZ%2BiB4%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878747&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=iDNw6vE3kbwHQ5l9ZpQLRzZ%2B%2BxZBfAhbxT5aqPZ%2BiB4%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9438ac99d89a865b-PER
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 21 KB
10 KB 407ms
303ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e32c326b6a4146639a8a4ae6283d29c8d4dc01f797a30c45e77fda39763dad3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dQiekhWnI%2B6o52Nrv5MUk%2B4OI7Qh19Q0EFk3%2F7z2MWuLXxKJP0RHiFa90oHzlQRZvStpeHFl2CBov1imcBGqwZxVL141VTSuYSb%2Fe6HyPNRgDxZEzW7yFtlPtfPY%2ByhCewT560Yx"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9438ac9a1a0c87c4-PER
access-control-allow-origin: https://paint.toys
content-length: 9466
server: cloudflare

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 501 B
851 B 605ms
187ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=986e1dd1-2f1b-447c-b8c8-40884a110772%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=8afe3038-9fd7-4bbe-863b-46d2fc992c22&l_pb_bid_id=68e24ddc94001d98&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=a55b7df3-979e-4437-9067-2425af8d27f2&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.5238004525268757
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 31b28220dcaf4d1d616eec9398e6ef5f36e19a4163469f9180ad6c6d7ff050ea

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 501
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 501 B
1022 B 597ms
180ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=986e1dd1-2f1b-447c-b8c8-40884a110772%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=8afe3038-9fd7-4bbe-863b-46d2fc992c22&l_pb_bid_id=6986ac9785ecfe9&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=916d61ae-1146-49e8-a6bb-23f0e49e1bf7&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.8451721153585563
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 9fb8bc8f4a28b076d25b11e4c6fd00918dd74088f1feff0dd9c5d97874a4457d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 501
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 506 B
858 B 612ms
194ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=986e1dd1-2f1b-447c-b8c8-40884a110772%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=8afe3038-9fd7-4bbe-863b-46d2fc992c22&l_pb_bid_id=7060578a096de69&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=5bfc5fe2-430a-412c-9f80-922898d27735&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.4526419852237299
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c093cb4918031b10ccfa6509f7febdc72f5bc5b2aa39cb9bb9ebf703fd5f77bd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 506
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 506 B
857 B 602ms
185ms Fetch
application/json 2602:803:c006:158::65
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=986e1dd1-2f1b-447c-b8c8-40884a110772%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=8afe3038-9fd7-4bbe-863b-46d2fc992c22&l_pb_bid_id=7117e3e9e2310e1&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=bc625ce6-d4ba-415c-93b5-42d4d97145e6&rp_maxbids=1&m_ch_mobile=%3F0&slots=1&rand=0.9581673587513962
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c006:158::65 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 40888b1ff42362b5c322943e77d53769c6e732a3879785af2bff2bc8a5998582

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 506
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 317ms
116ms Fetch 207.65.33.78
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.78 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:27 GMT
server: nginx

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 490ms
299ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: da33c38b4e614b96b89cfc48735855e90ea95887b34e8e9d6e22ab3a580ab4f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 103.108.231.107
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/plain
vary: Origin

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1218ms
572ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 01:52:28 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1185ms
541ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 01:52:28 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1148ms
504ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 01:52:28 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1238ms
596ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 01:52:28 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 438ms
241ms Fetch
application/json 2406:2600:7:100::1b
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::1b , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

6405abfd1ad77c1bd58c56b822a8ab0447da37eac1c1dd548ec1e5c3e9e6762a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 424ms
192ms Fetch
application/json 54.169.90.152
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.169.90.152 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-169-90-152.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 297ms
97ms Fetch
application/json 52.220.45.32
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747878747125&to=-480&aun=pw-160x600_atf&pubcid=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=a55b7df3-979e-4437-9067-2425af8d27f2&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.45.32 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-45-32.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 297ms
97ms Fetch
application/json 52.220.45.32
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747878747125&to=-480&aun=pw-160x600_btf&pubcid=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=916d61ae-1146-49e8-a6bb-23f0e49e1bf7&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.45.32 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-45-32.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 295ms
95ms Fetch
application/json 52.220.45.32
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747878747125&to=-480&aun=leaderboard_atf&pubcid=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=5bfc5fe2-430a-412c-9f80-922898d27735&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.45.32 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-45-32.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 296ms
96ms Fetch
application/json 52.220.45.32
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747878747125&to=-480&aun=leaderboard_btf&pubcid=c45c341a-3c7f-4f86-9217-1b22d8a2e0f2&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=bc625ce6-d4ba-415c-93b5-42d4d97145e6&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.45.32 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-45-32.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 85 B
626 B 440ms
247ms Fetch
application/json 18.67.93.17
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.67.93.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-67-93-17.syd62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 008f5c8cf3a4bd85978f237b83295b318b680b9dbb3bce64ba5ddcd7a712f816

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 11
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 f1646a7b70ef690faac638f9c1dd2364.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 110
x-amz-cf-id: Qynf724sAP-0nCpFwRJ-ENM_11VvHdMmVmFueSb8Fns1ZttCivkSTQ==
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
x-amz-cf-pop: SYD62-P1
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 470 B
1 KB 797ms
260ms Fetch
application/json 103.43.90.117
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.117 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

ba009f7024e2702ea2ee550c3c6d854f6542d3dd94649ca7576e10879a6415be

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 3a2b3343-17d5-4960-8532-214786c91e12
content-length: 470
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:27 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 2 KB
2 KB 395ms
292ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f77d7009fd1ba508ad9a826ec9c2a08acbd90c0fb9324789c3fed1edb382c07e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9438ac9a689a85b6-PER
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
462 B 642ms
355ms Fetch 2406:2600:7:100::2c
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=97042199595&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2c , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:27 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 545 B
712 B 392ms
173ms Fetch
application/json 13.212.151.188
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.212.151.188 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-212-151-188.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

ca000cbc918d83c596ba85bec61f009526fb392cbb45a323fb907da300f6337a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 356
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 570 B
740 B 411ms
193ms Fetch
application/json 13.212.151.188
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.212.151.188 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-212-151-188.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

f7163377414b824cd850fbeb99e966e4b719ab58b6eff85565c126636d859e9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 384
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 380 B
585 B 343ms
127ms Fetch
application/json 13.212.151.188
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.212.151.188 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-212-151-188.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

748b9d5934545df225c18f89e282afd28dee5dc9d76b8601291be13686b36358

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 229
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 492 B
696 B 340ms
122ms Fetch
application/json 13.212.151.188
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

13.212.151.188 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-212-151-188.ap-southeast-1.compute.amazonaws.com

Software

Resource Hash

cf68356f3cbb1c466ad9a54928534e5df4b93f5356899ff0d28c427a3cf5c4c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 339
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 289ms
94ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: sdgwsq.partysballoons.com.au
URL: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 22 May 2025 02:07:27 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 22 May 2025 01:52:27 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 106ms
103ms Script
text/javascript 108.158.32.17
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: sdgwsq.partysballoons.com.au
URL: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.158.32.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-158-32-17.syd3.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 25940
via: 1.1 99d08a30eb552b5891a16e6c0ba4a4ea.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: RrY1JFW0YgNIgAZhng4pFTRgckO_DFlQEFZsPiufIaX4uexhNdQC1g==
date: Wed, 21 May 2025 18:40:08 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: SYD3-P2
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 11 B
323 B 221ms
64ms Script
application/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&_it=amazon&partner_id=403
Requested by: Host: sdgwsq.partysballoons.com.au
URL: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a73f5986eb985871284e6e216372de3505634a97229de643216728d0fbfd6227

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"ba4f7a703ea78ac1b72b5fe1be4fb407"
age: 8
cf-ray: 9438ac9adf2b8652-PER
x-amz-request-id: 80DVRQA7C49HCA99
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
last-modified: Thu, 05 Dec 2024 20:48:49 GMT
x-amz-id-2: 7iZI9GWiQGAAZJqZ/9BLV+nOrjIhdaIeDQonP1go/ucMJB2iXOG52XWcxiEvEV9/+lr/KzTKOPw=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 170ms
61ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: ki/m3Le3r9nAnTxS3J6E2fDaQx2dr/+MN6oICk6GFPzlwEvFjoGLLZJ/Wx0gAE23oj86+bq9xJBSERakVhCH+Q==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 3425
x-amz-request-id: B229WSRG49TSPBE1
cf-ray: 9438ac9a9fff866a-PER
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 252ms
188ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: sdgwsq.partysballoons.com.au
URL: https://sdgwsq.partysballoons.com.au/909y0o6nwmvpnu3s0kmpjw8lRZ3lFY2dSemFkbVowUERKanlTQ3ctMzA3Ny0yNjczMDIyNy0wZmQ5MDI2Zi00Njk3LUJhbDRndlF4N0VWblJOWWJXOTNI/rq0rumxlruk/tqUN7ftxVYmKq2/446669272664929824405354129929267
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 22 May 2025 02:07:27 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 22 May 2025 01:52:27 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 539ms
386ms Fetch
text/plain 2800:3f0:4005:411::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55k1v9102396898za200zb9101576445&_p=1747878745611&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&ptag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=1917009361.1747878747&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747878747&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1747878745611&tfd=2505
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55k1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4005:411::200e , Argentina, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:27 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/ 537 KB
169 KB 327ms
327ms Script
text/javascript 142.251.133.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.133.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb14ba6e443cea8cf2f668d600a627bbf7af37cce884a57cc57082356087aa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12745184525860094308
age: 51347
x-content-type-options: nosniff
expires: Thu, 21 May 2026 11:36:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 21 May 2025 11:36:40 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173193
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505200101/ 63 KB
23 KB 390ms
389ms Other
text/plain 142.251.133.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505200101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.133.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-212-103-81.compute-1.amazonaws.com

Software

cafe /

Resource Hash

71599f3f2650b062aed2f01f9974f503eda91c1ed89486be19839813dc0578a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 1077713666436866443
age: 39067
x-content-type-options: nosniff
expires: Wed, 28 May 2025 15:01:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 21 May 2025 15:01:20 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23467
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505200101"

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 760ms
237ms XHR
application/octet-stream 35.162.56.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1747878747436&did=did-0046&se=e30&duid=8e413bd09c43--01jvtv26rwjaxcxkavk1e75p81&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.par...
https://rp4.liadm.com/j?dtstmp=1747878747436&did=did-0046&se=e30&duid=8e413bd09c43--01jvtv26rwjaxcxkavk1e75p81&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.pa...

13 B
370 B

1027ms
304ms

Fetch
application/json

52.7.88.100
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1747878747436&did=did-0046&se=e30&duid=8e413bd09c43--01jvtv26rwjaxcxkavk1e75p81&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjg6ZGVlOjoyZQ%3D%3D&n3pc=true
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.7.88.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-88-100.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 9558c8c3-562f-4bd6-b469-ff6c7f8fbae4
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 22 May 2025 01:52:29 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1747878747436&did=did-0046&se=e30&duid=8e413bd09c43--01jvtv26rwjaxcxkavk1e75p81&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&cd=.paint.toys&i6=MjQwNDpmNzgwOjg6ZGVlOjoyZQ%3D%3D&n3pc=true
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 01:52:28 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mi1pWGNEREIwdURmVl94a2VIWnVsSmVHSUFBQ1lTdWdnSGxibHNkZGZIXzg&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mi1pWGNEREIwdURmVl94a2VIWnVsSmVHSUFBQ1lTdWdnSGxibHNkZGZIXzg&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEGagzM3d63FI-eVtBsFiNbE&google_cver=1

70 B
440 B

94ms
93ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEGagzM3d63FI-eVtBsFiNbE&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:29 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEGagzM3d63FI-eVtBsFiNbE&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Thu, 22 May 2025 01:52:28 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=58b6dd6e-0487-43a4-94dd-0a35992da0b4&bid=1e2n4ou

70 B
440 B

94ms
93ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=58b6dd6e-0487-43a4-94dd-0a35992da0b4&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:27 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=58b6dd6e-0487-43a4-94dd-0a35992da0b4&bid=1e2n4ou
content-length: 191
date: Thu, 22 May 2025 01:52:27 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=5032325447999996024&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

110ms
94ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5032325447999996024&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:28 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=5032325447999996024&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 617.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 13a69417-7d07-4902-a80d-a6690fbb163b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:28 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=eyeota
https://ps.eyeota.net/match?bid=tpm4omv&uid=pbPfB3KrX-BhtlSRRWM4b2ds52s&gdpr=&gdpr_consent=

70 B
440 B

94ms
94ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=tpm4omv&uid=pbPfB3KrX-BhtlSRRWM4b2ds52s&gdpr=&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:28 GMT
Content-Type: image/gif

Redirect headers

Location: https://ps.eyeota.net/match?bid=tpm4omv&uid=pbPfB3KrX-BhtlSRRWM4b2ds52s&gdpr=&gdpr_consent=
Content-Length: 126
Date: Thu, 22 May 2025 01:52:28 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-tk1QSfhE2pWbzZnH9vItAfGKUWr5IlJ9iso-~A&gdpr=0

70 B
440 B

94ms
94ms

Image
image/gif

13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-tk1QSfhE2pWbzZnH9vItAfGKUWr5IlJ9iso-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:28 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-tk1QSfhE2pWbzZnH9vItAfGKUWr5IlJ9iso-~A&gdpr=0
age: 1
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 01:52:28 GMT
content-type: text/html
server: ATS

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 1949ms
302ms Image
text/plain 18.212.103.81
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.212.103.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 95ms
94ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 22 May 2025 02:07:27 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 22 May 2025 01:52:27 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H3 200 hxfnq8_ier4ji6tnkjbo8o5va Show response
faucetfoot.com/create/ 299 B
323 B 411ms
226ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/create/hxfnq8_ier4ji6tnkjbo8o5va

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

hoothoot/1797731198 /

Resource Hash

bddaf70d3ee22c36579cc68861c526b92a91046cf2e1814553c16eeccb96f755

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-asia-east1-spot-k6w1.gce-asia-east1, 1.1 google
expires: Thu, 22 May 2025 01:52:26 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Thu, 22 May 2025 01:52:27 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H/1.1

200
OK

iu3 Show response
s.amazon-adsystem.com/ Frame 17FD
Redirect Chain

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_...
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_...

400 B
1 KB

326ms
326ms

Document
text/html

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

459eb794482195e077ccbd5c4f6dec9a875298acdf3626aae170800708e2da98

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 400
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 22 May 2025 01:52:28 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 6SRS2S5KK87WR18QDQXJ

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 22 May 2025 01:52:28 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: BS2M0M0F87AAV8410HJ6

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 515ms
333ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 86174ed8a0b94f363ee59fc9e17e3ec24a5e7c988b31fc069d30fb8ef6efefd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 498ms
333ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=iGQVyPhu-DxJdislqP0-96f5b11a27&sid=aDmIny2X-aobGimsHrS-96f5b11a27&cv=2.1.101-2-g7338edb&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:28 GMT
vary: Origin

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 449ms
96ms XHR
application/json 2406:da18:a99:1b02:bd8d:f79f:23a1:e894
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2406:da18:a99:1b02:bd8d:f79f:23a1:e894 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 22 May 2025 02:22:28 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json
vary: origin
server: nginx

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 637ms
140ms Preflight
application/json 182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 01:52:27 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 198563
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
447 B 336ms
334ms Fetch
text/plain 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 01:52:28 GMT
content-type: text/plain;charset=utf-8
vary: Origin

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 1263ms
375ms Fetch
application/json 2001:41d0:701:1000::4aaf
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::4aaf , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: b3dbd534ed3f094764d32764799f8835deb38b22e6a66dc3edebd3bb949fa1f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
293 B 1023ms
339ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

02d647bf0b8fac32285bfe0901ddef7ef5261d9d5b6646ed6315c007ba7fad5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 56 B
292 B 1279ms
338ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

02d647bf0b8fac32285bfe0901ddef7ef5261d9d5b6646ed6315c007ba7fad5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 960ms
316ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 22 May 2025 01:52:28 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 916ms
305ms XHR
application/json 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 22 May 2025 01:52:28 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 94ms
94ms Script
application/javascript 23.38.131.47
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.38.131.47 Sydney, Australia, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-38-131-47.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 22 May 2025 02:07:28 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 22 May 2025 01:52:28 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 1140ms
414ms Script
application/javascript 2800:3f0:4005:406::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2800:3f0:4005:406::200e , Argentina, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

956e12c305f2b706de4131bf627b62e91eae1f1d49411c426968bbda2b38259e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-eOhXa-su5ogJ7g1UW8R3FQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:29 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw15BiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wZrEfpO1CIhDHW-yxoJw2k3WVCBes_EW6xYgbtK-zdoFxGZ-t1ntgFiIh-Nu266DbAIP9j-_zaikkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAAF9VDpA"
content-security-policy: script-src 'report-sample' 'nonce-eOhXa-su5ogJ7g1UW8R3FQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 1B4F 2 KB
2 KB 724ms
239ms Document
text/html 54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: 793ca2ade34c965e8c28329907bd25f73094246a1a61827d3f3a9db74a78a6ef

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 1758
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 / Show response
d0.eu-3-id5-sync.com/ 1 B
143 B 1045ms
341ms Fetch
text/plain 135.125.140.162
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.140.162 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip162.ip-135-125-140.eu
Software: /
Resource Hash: 3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-3-id5-sync.com/ 1 B
143 B 1037ms
333ms Fetch
text/plain 51.195.127.115
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.127.115 , Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip115.ip-51-195-127.eu
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-3-id5-sync.com/ 1 B
143 B 1031ms
338ms Fetch
text/plain 51.195.34.220
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.220 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip220.ip-51-195-34.eu
Software: /
Resource Hash: 559aead08264d5795d3909718cdd05abd49572e84fe55590eef31a88a08fdffd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-3-id5-sync.com/ 1 B
143 B 1016ms
332ms Fetch
text/plain 51.195.73.71
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.71 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip71.ip-51-195-73.eu
Software: /
Resource Hash: 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-3-id5-sync.com/ 1 B
143 B 1025ms
341ms Fetch
text/plain 51.195.73.71
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.71 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip71.ip-51-195-73.eu
Software: /
Resource Hash: 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-3-id5-sync.com/ 1 B
143 B 1013ms
332ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-3-id5-sync.com/ 1 B
143 B 1027ms
335ms Fetch
text/plain 51.195.73.74
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.74 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip74.ip-51-195-73.eu
Software: /
Resource Hash: d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-3-id5-sync.com/ 1 B
143 B 1040ms
338ms Fetch
text/plain 51.195.115.36
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-3-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.115.36 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip36.ip-51-195-115.eu
Software: /
Resource Hash: 4b227777d4dd1fc61c6f884f48641d02b4d121d3fd328cb08b5531fcacdabf8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d0.eu-4-id5-sync.com/ 1 B
143 B 1043ms
341ms Fetch
text/plain 51.195.73.113
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d0.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.113 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip113.ip-51-195-73.eu
Software: /
Resource Hash: a9f51566bd6705f7ea6ad54bb9deb449f795582d6529a0e22207b8981233ec58

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d1.eu-4-id5-sync.com/ 1 B
143 B 1026ms
336ms Fetch
text/plain 51.195.73.113
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d1.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.113 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip113.ip-51-195-73.eu
Software: /
Resource Hash: a9f51566bd6705f7ea6ad54bb9deb449f795582d6529a0e22207b8981233ec58

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d2.eu-4-id5-sync.com/ 1 B
143 B 1034ms
334ms Fetch
text/plain 51.195.73.71
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d2.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.71 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip71.ip-51-195-73.eu
Software: /
Resource Hash: 19581e27de7ced00ff1ce50b2047e7a567c76b1cbaebabe5ef03f7c3017bb5b7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d3.eu-4-id5-sync.com/ 1 B
143 B 1043ms
343ms Fetch
text/plain 51.195.34.222
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d3.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.222 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip222.ip-51-195-34.eu
Software: /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d4.eu-4-id5-sync.com/ 1 B
143 B 1031ms
332ms Fetch
text/plain 135.125.145.78
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d4.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.145.78 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip78.ip-135-125-145.eu
Software: /
Resource Hash: ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d5.eu-4-id5-sync.com/ 1 B
143 B 1028ms
340ms Fetch
text/plain 135.125.140.162
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d5.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 135.125.140.162 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip162.ip-135-125-140.eu
Software: /
Resource Hash: 3f39d5c348e5b79d06e842c114e6cc571583bbf44e4b0ebfda1a01ec05745d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d6.eu-4-id5-sync.com/ 1 B
143 B 999ms
330ms Fetch
text/plain 51.195.34.255
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d6.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.34.255 , Jordan, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip255.ip-51-195-34.eu
Software: /
Resource Hash: 6b23c0d5f35d1b11f9b683f0b0a617355deb11277d91ae091d399c655b87940d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H2 200 / Show response
d7.eu-4-id5-sync.com/ 1 B
143 B 1010ms
333ms Fetch
text/plain 51.195.73.74
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://d7.eu-4-id5-sync.com/
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.195.73.74 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ip74.ip-51-195-73.eu
Software: /
Resource Hash: d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-headers: *
access-control-max-age: 3600
access-control-allow-origin: *
content-length: 1
content-type: text/plain
access-control-allow-methods: GET, OPTIONS

GET
H/1.1 200
OK pr Show response
s.amazon-adsystem.com/v3/ Frame B5F5 4 KB
4 KB 308ms
307ms Document
text/html 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

4f5d3549d9ec6d06b6f69a47ac33522023e10cdf6c52690c3c7a2acc8bd1a50d

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&dl=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-smadex_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&dcc=t
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 3720
Content-Type: text/html;charset=ISO-8859-1
Date: Thu, 22 May 2025 01:52:29 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: RM4M9F99420ZW76W3Q6F

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
703 B 333ms
322ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: ab8d6e7af2e426088a70b89a56b40f8aeebe096c14e09b0b9b36e3da57b70fb7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 333ms
322ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 329ms
319ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 329ms
319ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 852 B
1 KB 336ms
335ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

d7069db4a0900423e99709e667ec8e8563fcfa29299817ab04a633fd90dd44f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: application/json
vary: Origin

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://ssp-sync.criteo.com/user-sync/amazon/redirect?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24UID
https://dis.criteo.com/dis/usersync.aspx?r=73&p=362&dis=0&url=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fredirect%3fuid%3d%40%40CRITEO_USERID%40%40%26dised%3dtrue%26gdpr%3d%26gdprapplies%3dFal...
https://widget.as.criteo.com/dis/usersync.aspx?r=73&p=362&dis=0&url=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fredirect%3fuid%3d%40%40CRITEO_USERID%40%40%26dised%3dtrue%26gdpr%3d%26gdprapplies...
https://ssp-sync.criteo.com/user-sync/redirect?uid=6e34f70f-b6c2-4a8b-9c0f-0c4d536fb289&dised=true&gdpr=&gdprapplies=False&ccpa=&gpp=&gpp_sid=&profile=362&redir=https%253A%252F%252Fssp-sync.criteo....
https://x.bidswitch.net/sync?ssp=criteo&custom_data=xE651V9mVEtpZDFtQ2FXSHZiMHhqS282OUNzMkVtb1JHbWM1ZlFYODVSRzBkTkJ5VSUyRlVrSUl4RjI0aTNrVWdNT2Iwc0t2aFZiWCUyQk9oOUZkeW9HZmdxN3g4YjBzT3U1UCUyQmJsN1lzU...
https://ssp-sync.criteo.com/user-sync/match?p=xE651V9mVEtpZDFtQ2FXSHZiMHhqS282OUNzMkVtb1JHbWM1ZlFYODVSRzBkTkJ5VSUyRlVrSUl4RjI0aTNrVWdNT2Iwc0t2aFZiWCUyQk9oOUZkeW9HZmdxN3g4YjBzT3U1UCUyQmJsN1lzUUVsd00...
https://ssp-sync.criteo.com/user-sync/amazon/redirect/complete?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmediagrid.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=4856bb54-744d-4456-ab03-cb5400f9496c

43 B
479 B

322ms
322ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=4856bb54-744d-4456-ab03-cb5400f9496c

Requested by

Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6W1RPZZRHZXSRHQTKJTF
Content-Length: 43
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=31536000; preload;
location: https://s.amazon-adsystem.com/ecm3?ex=mediagrid.com&id=4856bb54-744d-4456-ab03-cb5400f9496c
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=amazon&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=amazon&zcc=1&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3D%5BRX_UUID%5D&cb=1747878750106
https://ad.turn.com/r/cs?pid=45&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004&rndcb=6564071135
https://sync.1rx.io/usersync/turn/8423308747176845506?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-4c076cea-781f-4cdc-b698-8f6b...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004

43 B
479 B

309ms
308ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: TQ4H8YGVSH5RDGTCYRQ1
Content-Length: 43
Date: Thu, 22 May 2025 01:52:32 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 22 May 2025 01:52:31 GMT
etag: RX4c076cea781f4cdcb6988f6b96eb1187004
content-type: text/html

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3908803494530565000V10

43 B
479 B

913ms
309ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3908803494530565000V10

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: WSY91A0W90SV96DEGNKX
Content-Length: 43
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3908803494530565000V10
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 22 May 2025 01:52:29 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 22 May 2025 01:52:29 GMT
Content-Type: text/html
Server: Apache

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID
https://match.prod.bidr.io/cookie-sync/amzn?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dbeeswax.com%26id%3D%24UID&_bee_ppp=1
https://s.amazon-adsystem.com/ecm3?id=AAF9a07QXQcAABtQeK9eUw&ex=beeswax.com

43 B
479 B

481ms
307ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=AAF9a07QXQcAABtQeK9eUw&ex=beeswax.com

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: FCW107KEJPN73GYJNNCD
Content-Length: 43
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://s.amazon-adsystem.com/ecm3?id=AAF9a07QXQcAABtQeK9eUw&ex=beeswax.com
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
Server: gunicorn
Connection: keep-alive

GET
H2 204 amazon-us
tr.blismedia.com/v1/api/sync/ Frame B5F5 0
170 B 368ms
172ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/amazon-us?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dblis.com%26id%3D%25%25BLIS_USER_TOKEN%25%25
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

via: 1.1 google
date: Thu, 22 May 2025 01:52:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame B5F5
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub12058951686464&k=us
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=ec1ee158faecc4d&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub12058951686464
https://t.adx.opera.com/sync?vendor=60369&pubid=pub12058951686464
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPU57df70adc15c4db1b7b05e32fff3d23f

43 B
479 B

929ms
328ms

Image
image/gif

52.95.115.255
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPU57df70adc15c4db1b7b05e32fff3d23f

Requested by

Protocol

HTTP/1.1

Server

52.95.115.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 66HQ6TMC2W5WBFK3N3VH
Content-Length: 43
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=opera.com&id=OPU57df70adc15c4db1b7b05e32fff3d23f
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
expires: Mon, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
content-length: 120
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/html; charset=utf-8
server: Tengine
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok

43 B
479 B

868ms
309ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: X9CG6B0SAS3VM091HV30
Content-Length: 43
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
content-length: 0
Content-Type: text/html

GET
H2 200 101959
jadserve.postrelease.com/suid/ Frame B5F5 43 B
534 B 863ms
238ms Image
image/gif 52.11.189.136
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/101959?ntv_r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dnativo.com%26id%3DNTV_USER_ID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.11.189.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-11-189-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
expires: Mon, 1 Jan 1990 12:00:00 GMT
access-control-allow-origin: *
content-length: 43
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
server: nginx

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B5F5
Redirect Chain

https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__
https://b1sync.outbrain.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&s=2
https://b1sync.zemanta.com/usersync/amazon_tam/?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Doutbrain.com%26id%3D__ZUID__&obuid=37778bff-a520-4ec0-8d32-4d8e3e90bfa1&s=2
https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=37778bff-a520-4ec0-8d32-4d8e3e90bfa1

43 B
479 B

315ms
314ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=37778bff-a520-4ec0-8d32-4d8e3e90bfa1

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: QWFWKS1XARMPHGE5X9GC
Content-Length: 43
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://s.amazon-adsystem.com/ecm3?ex=outbrain.com&id=37778bff-a520-4ec0-8d32-4d8e3e90bfa1
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 117
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html; charset=utf-8

GET
H2 200 amzns2s Show response
rtb.gumgum.com/usync/ Frame BAEE 3 KB
1 KB 296ms
95ms Document
text/html 54.255.109.145
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.255.109.145 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-255-109-145.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 8a7bcfad58862e1d4763e513b8a058257e8dde0882cc90c924a5b0799065d7a3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 22 May 2025 01:52:29 GMT
etag: W/"0294d78dfca0e780bfae5dca2ad275c46"
server: nginx
timing-allow-origin: *

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

2 KB
779 B

115ms
113ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 970121b65270dc51a8b7d3e44c3160f71f13cb85243c462235c6a9677800330e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9438aca88ae3120c-PER
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NuxlqM7lI4ru4cPpnaoLBJgd1G5nfrWTTCjR8A4pYrPeYv6mDup2xdR2H%2F9Chj5z4LhXqYpb006lWTEESeygvnIRmypwA0zZKVHFyAJcdzZjZaMaunZF5fDCx%2BmBleUuKen2HjSJc1gqLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9438aca7c9ac120c-PER
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IqbTAcG3us9w7FbaZ5a%2B0ElT2fy%2BcGQDpZXFiOEQW%2FSYB1ArPMcUfqoTAkudMuvCf6yUuHDckraVXKK9heettmoSLvqjka6xt1gNjsJ%2F%2FBcK%2FaRVEQaf1X15wukO9Ysvje9f8ShyW1x6JA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 7641
Redirect Chain

https://u.openx.net/w/1.0/cm?id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX...

714 B
940 B

172ms
171ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 328c94406f2b38f30cd473078c9aa863b565df114efbb4b1ce043b096d17a084

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 714
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.107

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 22 May 2025 01:52:29 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.107

GET
H2

200

sync Show response
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://sync.inmobi.com/TAM?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true

6 KB
6 KB

335ms
335ms

Document
text/html

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to

Full URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: 846f2ce5aeaf0a7c49c55820d3ca77666a82e240fd5f675cdd922485f01105f8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 5902
content-type: text/html;charset=UTF-8
date: Thu, 22 May 2025 01:52:29 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via: 1.1 google

Redirect headers

content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
location: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via: 1.1 google

GET /
match.sharethrough.com/jwumXNuB/v1/ Frame 70B3 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 75F8 20 KB
7 KB 94ms
94ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=164456
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
expires: Fri, 23 May 2025 23:33:25 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 tamptsync Show response
sync-amz.ads.yieldmo.com/ Frame 9949 1 KB
1 KB 334ms
96ms Document
text/html 13.228.207.78
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Requested by: Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-mediagrid_n-index_rx_n-MediaNet_n-Beeswax_ox-db5_n-inmobi_n-blis_n-opera3pb_n-sharethrough_pm-db5_ym_rbd_n-nativo_3lift_n-Outbrain&fv=1.0&a=cm&cm3ppd=1&dmt=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.228.207.78 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-228-207-78.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: a452c69a6afaef45d9874b8e3135044cee903b57c6b4e189c86bfda0c746fc1b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers: Cache-Control, Pragma, *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-encoding: gzip
content-type: text/html;charset=utf-8
date: Thu, 22 May 2025 01:52:29 GMT
pragma: no-cache
vary: accept-encoding

GET
H/1.1

200
OK

ecm3 Show response
s.amazon-adsystem.com/ Frame 0228
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4121983795314583415044

43 B
479 B

476ms
309ms

Document
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4121983795314583415044

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:30 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: GHNFQC5CTWZZHY8JRCE9

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
location: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4121983795314583415044
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET v1
match.sharethrough.com/universal/ Frame 1B4F 0
0

GET
H2

200

cs
cs.yellowblue.io/ Frame 1B4F
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=5032325447999996024

0
354 B

238ms
237ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=5032325447999996024
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=5032325447999996024
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 5292928e-b313-4ae3-9d15-f4a7ab221ccb
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame 1B4F
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=a02deb7a-d846-4d3d-b2c2-941aaa052bb8

0
354 B

238ms
238ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=a02deb7a-d846-4d3d-b2c2-941aaa052bb8
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=a02deb7a-d846-4d3d-b2c2-941aaa052bb8
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 01:52:30 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-lax-1-5-17
x-xss-protection: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame 1B4F
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=0

0
354 B

240ms
239ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=0
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
server: _

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1B4F
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&sub=typeaholdings
https://sync.1rx.io/usersync2/rmpssp?sub=typeaholdings&zcc=1&cb=1747878750105
https://ad.turn.com/r/cs?pid=45&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004&rndcb=1484782215
https://sync.1rx.io/usersync/turn/8423308747176845506?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drhythmone.com%26id%3DRX-4c076cea-781f-4cdc-b698-8f6b...
https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004

43 B
479 B

309ms
309ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: RZWM2T3P190EAT2E8H0Z
Content-Length: 43
Date: Thu, 22 May 2025 01:52:32 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=rhythmone.com&id=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 22 May 2025 01:52:31 GMT
etag: RX4c076cea781f4cdcb6988f6b96eb1187004
content-type: text/html

GET
H2

200

cs
cs.yellowblue.io/ Frame 1B4F
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3908803495036392000V10

0
354 B

245ms
241ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3908803495036392000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3908803495036392000V10
timing-allow-origin: *
pragma: no-cache
expires: Thu, 22 May 2025 01:52:29 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame 1B4F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
https://us-u.openx.net/w/1.0/cm?cc=1&gdpr=0&gdpr_consent=&id=58ceaaf5-c766-4c17-869a-d76e43401714&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26id%3D
https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f5171181-c89e-4bcb-aae0-31e54ad0cb53

0
354 B

238ms
237ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f5171181-c89e-4bcb-aae0-31e54ad0cb53
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&id=f5171181-c89e-4bcb-aae0-31e54ad0cb53
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:28 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H3 200 setuid
prebid.intergient.com/ Frame 1B4F 0
808 B 353ms
296ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aClZNRN9k
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878749&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=hp8a%2FU%2F1B%2BgGoZoowXqkvPGQab6G3X8KKnpZOFjRV74%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878749&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=hp8a%2FU%2F1B%2BgGoZoowXqkvPGQab6G3X8KKnpZOFjRV74%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9438aca7b95e865f-PER
server: cloudflare

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 98B0
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-west&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-west&p=rise_engage

269 B
379 B

290ms
97ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-west&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-west&p=rise_engage
server: AkamaiGHost

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame EC96
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Ks3wALZHDoIntLdTQECcC3rE

0
354 B

238ms
237ms

Document
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Ks3wALZHDoIntLdTQECcC3rE
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 22 May 2025 01:52:30 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=Ks3wALZHDoIntLdTQECcC3rE
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 75F8 2 KB
2 KB 292ms
95ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=36645635&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.81 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 940ed6cd94c4a3f1869a9a6c626097cf9bd07e01ca98057e171e083537f7fc82

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1688
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/html; charset=UTF-8

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 316ms
314ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=27b1aa74-fc51-4bf6-9e7b-c5da0302cffd&ccsid=5c12775f-fa49-4fe5-b4db-45734bec99b5
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 17 KB
5 KB 318ms
316ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: bb49a28501d03a18c34788c4f2ce63bb58c188deb99bb62b4698de3534456bad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3

200

cm Show response
u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

804 B
824 B

173ms
172ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0cbfaee083c8b4257a58d47b869d784457aa30ef18834570e135a3fe2b4905ca

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 804
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.107

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 22 May 2025 01:52:28 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 103.108.231.107

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=5032325447999996024

35 B
250 B

243ms
100ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=5032325447999996024
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: no-store, no-cache, private
location: https://usersync.gumgum.com/usersync?b=apn&i=5032325447999996024
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 093e391b-df5c-43c3-80c7-ccd2307f11c6
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=a_7e31ab0d-e763-451a-ac47-8c0430db59f6&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=a_7e31ab0d-e763-451a-ac47-8c0430db59f6&gdpr=&gdpr_consent=&us_privacy=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=4856bb54-744d-4456-ab03-cb5400f9496c
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=4856bb54-744d-4456-ab03-cb5400f9496c
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=e2881261-8026-4682-943e-08208676104e&user_group=1&ssp=gumgum2&bsw_param=4856bb54-744d-4456-ab03-cb5400f9496c
https://usersync.gumgum.com/usersync?b=bsw&i=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=

35 B
250 B

110ms
109ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:31 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //usersync.gumgum.com/usersync?b=bsw&i=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:31 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_=%7BCACHEBUSTER%7D&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=ae7fc430-b72c-4412-bf44-8e43aee3baf5

35 B
250 B

333ms
102ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=ae7fc430-b72c-4412-bf44-8e43aee3baf5
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://usersync.gumgum.com/usersync?b=opx&i=ae7fc430-b72c-4412-bf44-8e43aee3baf5
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=pbPfB3KrX-BhtlSRRWM4b2ds52s

35 B
250 B

100ms
99ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=pbPfB3KrX-BhtlSRRWM4b2ds52s
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=pbPfB3KrX-BhtlSRRWM4b2ds52s
Content-Length: 99
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-nccrGP1E2pdHaQM1AvwH3hjzO0zi1Hmw.kiB~A

35 B
250 B

379ms
98ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-nccrGP1E2pdHaQM1AvwH3hjzO0zi1Hmw.kiB~A
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://usersync.gumgum.com/usersync?b=oth&i=y-nccrGP1E2pdHaQM1AvwH3hjzO0zi1Hmw.kiB~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%...
https://usersync.gumgum.com/usersync?b=vnt&i=569450b1-6135-4f0c-b022-66ae1822fb31

35 B
250 B

100ms
99ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=569450b1-6135-4f0c-b022-66ae1822fb31
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

X-CI-RTID: a13535e2-1a3f-44b6-85e7-0f5ef12e6257
Location: https://usersync.gumgum.com/usersync?b=vnt&i=569450b1-6135-4f0c-b022-66ae1822fb31
Content-Length: 108
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 142
match.deepintent.com/usersync/ Frame BAEE 0
44 B 903ms
300ms Image
text/plain 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

date: Thu, 22 May 2025 01:52:30 GMT
server: b
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=a_7e31ab0d-e763-451a-ac47-8c0430db59f6&gdpr=&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://b1sync.outbrain.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&puid=a_7e31ab0d-e763-451a-ac47-8c0430db59f6&s=2&us_privacy=
https://b1sync.zemanta.com/usersync/gumgum/?cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__&gdpr=&gdpr_consent=&obuid=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4&puid=a_7e31ab0d-e...
https://usersync.gumgum.com/usersync?b=zem&i=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4

35 B
250 B

98ms
97ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&i=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:31 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://usersync.gumgum.com/usersync?b=zem&i=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 108
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame BAEE
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&us_privacy=&gpp=&gpp_sid=&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=M3DA71mHAgeB&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355

35 B
208 B

101ms
100ms

Image
image/gif

54.255.109.145
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=M3DA71mHAgeB&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Server: 54.255.109.145 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-255-109-145.ap-southeast-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
expires: 0
content-length: 35
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif;charset=UTF-8
server: nginx

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://rtb.gumgum.com/usersync?b=pln&i=M3DA71mHAgeB&ev=1&gpp_sid=&gpp=&us_privacy=&pid=558355
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-88cdcf969-kkgr5
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-AU
server: Jetty(12.0.17)

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame BAEE
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=9028848940065124472

35 B
250 B

490ms
105ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=9028848940065124472
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

cache-control: no-cache,no-store
location: https://usersync.gumgum.com/usersync?b=sad&i=9028848940065124472
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 22 May 2025 01:52:29 GMT
pragma: no-cache

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame BAEE 43 B
479 B 322ms
322ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=a_7e31ab0d-e763-451a-ac47-8c0430db59f6

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://rtb.gumgum.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: RKZ3EED4BNGX95E6ZM2T
Content-Length: 43
Date: Thu, 22 May 2025 01:52:29 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame E238
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=1301&gdpr=&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=1301&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=adf&i=122222340544038586&gdpr=&gdpr_consent=

35 B
250 B

99ms
98ms

Document
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=adf&i=122222340544038586&gdpr=&gdpr_consent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:30 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
expires: -1
location: https://usersync.gumgum.com/usersync?b=adf&i=122222340544038586&gdpr=&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 5035 170 B
232 B 1122ms
400ms Document
image/png 142.251.132.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=YV83ZTMxYWIwZC1lNzYzLTQ1MWEtYWM0Ny04YzA0MzBkYjU5ZjY=&gdpr=&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv

Requested by

Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 01:52:30 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 290F 20 KB
7 KB 94ms
93ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=&gdprConsent=
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=164456
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
expires: Fri, 23 May 2025 23:33:25 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame D0CE
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=&gdpr_consent=
https://usersync.gumgum.com/usersync?b=ttd&i=58b6dd6e-0487-43a4-94dd-0a35992da0b4

35 B
250 B

387ms
96ms

Document
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=ttd&i=58b6dd6e-0487-43a4-94dd-0a35992da0b4
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:30 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 193
date: Thu, 22 May 2025 01:52:29 GMT
location: https://usersync.gumgum.com/usersync?b=ttd&i=58b6dd6e-0487-43a4-94dd-0a35992da0b4
server: Kestrel

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 1125
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=aC6DXsCo8G0AAIblqX4AAAAA

35 B
250 B

104ms
99ms

Document
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=aC6DXsCo8G0AAIblqX4AAAAA
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:30 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=aC6DXsCo8G0AAIblqX4AAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 3
X-SO-Cluster-ID: 0
X-SO-HostName: m-ad97.dc4p.scaleout.jp
X-SO-IP: 103.108.231.107
X-SO-Key: aC6DXsCo8G0AAIblqX4AAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.107","key":"aC6DXsCo8G0AAIblqX4AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad97"}
X-SO-LB-Hostname: m-ng9.dc4p.scaleout.jp
X-SO-Upstream-ID: m-ad97

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 5452
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=gumgum&tc=1

35 B
250 B

98ms
97ms

Document
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=gumgum&tc=1
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:31 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT Thu, 22 May 2025 01:52:31 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=gumgum&tc=1
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B2B2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

269 B
379 B

190ms
96ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://rtb.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 01:52:29 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 01:52:29 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 9949 43 B
479 B 312ms
311ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=xISawYYK3oYJ78oaKAnk

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 643ST2V998S9GCJCV8JE
Content-Length: 43
Date: Thu, 22 May 2025 01:52:29 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 9949
Redirect Chain

https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?extinit=0&userid=$UID&pn_id=an
https://ads.yieldmo.com/v000/sync?extinit=0&userid=5032325447999996024&pn_id=an

43 B
710 B

99ms
98ms

Image
image/gif

54.251.34.228
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?extinit=0&userid=5032325447999996024&pn_id=an
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 54.251.34.228 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-34-228.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

cache-control: no-store, no-cache, private
location: https://ads.yieldmo.com/v000/sync?extinit=0&userid=5032325447999996024&pn_id=an
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ab3f52e7-8189-456a-b857-abae997c6478
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 9949 170 B
232 B 1049ms
393ms Image
image/png 142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_hm=eElTYXdZWUszb1lKNzhvYUtBbms=

Requested by

Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 /
wt.rqtrk.eu/ Frame 9949 43 B
351 B 1045ms
340ms Image
image/gif 57.129.18.111
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://wt.rqtrk.eu/?pid=fc4e1fcf-7b7a-41b5-a689-0f1570fe8fea&src=www&type=100&sid=0&uid=xISawYYK3oYJ78oaKAnk&cb=1747878749561&url={{REFERRER}}&gdpr=0&gdpr_consent=
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 57.129.18.111 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: haproxy-eu-013.roqad.pl
Software: istio-envoy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

cache-control: no-cache,private
pragma: no-cache
x-envoy-upstream-service-time: 4
expires: Thu, 22 May 2025 01:52:29 GMT
content-length: 43
p3p: CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
server: istio-envoy

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 9949
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=xISawYYK3oYJ78oaKAnk
https://ads.yieldmo.com/v000/sync?tdid=58b6dd6e-0487-43a4-94dd-0a35992da0b4

43 B
727 B

309ms
96ms

Image
image/gif

54.251.34.228
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?tdid=58b6dd6e-0487-43a4-94dd-0a35992da0b4
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 54.251.34.228 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-34-228.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

location: https://ads.yieldmo.com/v000/sync?tdid=58b6dd6e-0487-43a4-94dd-0a35992da0b4
content-length: 181
date: Thu, 22 May 2025 01:52:29 GMT
server: Kestrel

GET
H2

200

sync
ads.yieldmo.com/v000/ Frame 9949
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEIYbSlQrIYSxDMTMRf45woU&google_cver=1

43 B
717 B

99ms
95ms

Image
image/gif

54.251.34.228
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEIYbSlQrIYSxDMTMRf45woU&google_cver=1
Requested by: Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID
Protocol: H2
Server: 54.251.34.228 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-251-34-228.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync-amz.ads.yieldmo.com/

Response headers

pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 43
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEIYbSlQrIYSxDMTMRf45woU&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 299
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 4938 43 B
855 B 918ms
311ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aC6DXYsFVUEALJJFAK69igAAEokAAAAB&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-175-44-74.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: GKCBZVPHVSP2E3PWN47T
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK 31327
i.liadm.com/s/ Frame 4938 0
208 B 1272ms
316ms Image
text/plain 54.175.44.74
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aC6DXYsFVUEALJJFAK69igAA%264745&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.175.44.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
trace-id: 6a65ae0cf8104df3
Request-Time: 0
Connection: keep-alive

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&expiration=1750470749&gdpr=0&gdpr_consent=

43 B
345 B

111ms
109ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&expiration=1750470749&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l%2F9h0gbfxnBn1z%2F2Gn%2BGTq9psTqahugcmQ%2BIERet%2FDApM1%2FHfSfYgGf27cpfYLYwg7bGzDTtsmNLN1h4mlueCDl%2B%2FGR0Ie%2BApYLWu22uOL69IyTif7enHAHxObbElvu%2FBqq9dMYjfWq3lA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9438acaade34120c-PER
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&expiration=1750470749&gdpr=0&gdpr_consent=
content-length: 323
date: Thu, 22 May 2025 01:52:29 GMT
server: Kestrel

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aC6DXYsFVUEALJJFAK69igAAEokAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOCU8PDzrbzdjJUcrHmhQD8&google_cver=1

43 B
762 B

116ms
113ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOCU8PDzrbzdjJUcrHmhQD8&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OV46r8NGs3mpCZguF%2FoWEy5RytIRc2lIc6y9UqjTJFKRZ729mr5%2FHS4kPO45wNEzPezt1MN7opxKru3Qmze9gRXkHims0QHzz33OWhfUvCZsDSOHtj8OBw9gpekyNP5jCe5TWVq0f58mbw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb22d5c8643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEOCU8PDzrbzdjJUcrHmhQD8&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 aC6DXYsFVUEALJJFAK69igAAEokAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 4938 43 B
519 B 232ms
105ms Image
image/gif 2406:da18:929:5a01:64c8:d37f:b7df:45bb
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/aC6DXYsFVUEALJJFAK69igAAEokAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2406:da18:929:5a01:64c8:d37f:b7df:45bb Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=c9be75e7-848a-9739-e4afb19c

43 B
797 B

115ms
115ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=c9be75e7-848a-9739-e4afb19c
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6mt67I3U47%2BhU0%2BrytU3nQXKRAbWOgOFb2uPxZbvZEMXVseoxregvO92qICYHHc4e9htgYsOxWmDF6Z9qsRlUSPkRYIM8XQzCrrAcT0aOR7xmfsdiJC0zH0eqtbzvkyJCL07IWUbykdVnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acaca9298643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: max-age=3600
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=c9be75e7-848a-9739-e4afb19c
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP='This is not a P3P policy!'
content-length: 146
date: Thu, 22 May 2025 01:52:29 GMT
content-type: text/html; charset=utf-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://ksk.t.zucks.net/ie/cs
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=233&external_user_id=ef35d7b9-fb9c-45ba-90b7-841210a3b63e

43 B
762 B

117ms
117ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=233&external_user_id=ef35d7b9-fb9c-45ba-90b7-841210a3b63e
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FnqZGGwTm4JJ8R17EEcnQs5O3b0YMN%2FmfNgmF5ZU862k9vNfPCRCaqfHda04MiKHtyqdu754OH3FjNl512IVWhMmCIKca%2FZqc5XOvhDqax5Jn8j0jRjzJYn4679amfG0cPMFWlx7G98DrA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acae3a8a8643-PER
content-length: 43
server: cloudflare

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=233&external_user_id=ef35d7b9-fb9c-45ba-90b7-841210a3b63e
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
Connection: keep-alive

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1763776350&external_user_id=4d8b1284-6597-4abc-b992-c344c87c895a

43 B
765 B

114ms
113ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1763776350&external_user_id=4d8b1284-6597-4abc-b992-c344c87c895a
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TQ088IHVz6cKtfXn9joyhR19cZvW9zBdmzcRLCD0bzsJx1WN%2F7rdf%2BplDp2%2FRmpkG9nL1d6UGZzVdIRftXpsFhiSzTAmAEmUZn8KzKBHsU5k0OK%2FYaTyxFbwv8RUvq2qXz4sJZ38xI0Lhg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acad79d28643-PER
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1763776350&external_user_id=4d8b1284-6597-4abc-b992-c344c87c895a
access-control-allow-methods: GET,OPTIONS
via: 1.1 google
access-control-allow-origin: *.casalemedia.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 4938 43 B
479 B 916ms
312ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=index.com&id=aC6DXYsFVUEALJJFAK69igAAEokAAAAB

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&s=192259&C=1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: JYEE3QQN4VN58MJRDW3T
Content-Length: 43
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame CD72
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=379DA860-367D-482E-BB52-F3FEE924EE87&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=379DA860-367D-482E-BB52-F3FEE924EE87&gdpr=0&gdpr_consent=

35 B
591 B

262ms
260ms

Document
image/gif

185.84.60.23
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=379DA860-367D-482E-BB52-F3FEE924EE87&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.84.60.23 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 22 May 2025 01:52:30 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=379DA860-367D-482E-BB52-F3FEE924EE87&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 82E1
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a9f1682e-835e-4d00-80bf-a9b10fb938b1&gdpr=0&gdpr_consent=

42 B
438 B

290ms
96ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a9f1682e-835e-4d00-80bf-a9b10fb938b1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 01:52:29 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Cross-Origin-Resource-Policy: cross-origin
Date: Thu, 22 May 2025 01:52:30 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Pragma: no-cache
Referrer-Policy: strict-origin
Server: MT3 1910 c395da2 master iad iad-pixel-x23 config_version:"2834"
Strict-Transport-Security: 31536000
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: all
X-XSS-Protection: 0
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:a9f1682e-835e-4d00-80bf-a9b10fb938b1&gdpr=0&gdpr_consent=

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame DEC1 43 B
479 B 495ms
311ms Document
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=379DA860-367D-482E-BB52-F3FEE924EE87

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 22 May 2025 01:52:30 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: A9AXFRE6SJKEFJJCWK7Q

GET
H2

200

sync
pippio.com/api/ Frame 75F8
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=379DA860-367D-482E-BB52-F3FEE924EE87
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJDM3OURBODYwLTM2N0QtNDgyRS1CQjUyLUYzRkVFOTI0RUU4NxAAGg0I3oa6wQYSBQjoBxAAQgBKAA
https://pippio.com/api/sync?pid=5324&it=1&iv=7e6d38a7bd02cf490e63e950404e5ea47c89171a694329f3392cbdaa581a0f59791426b5417dce21&_=2

42 B
570 B

495ms
312ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&it=1&iv=7e6d38a7bd02cf490e63e950404e5ea47c89171a694329f3392cbdaa581a0f59791426b5417dce21&_=2
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&it=1&iv=7e6d38a7bd02cf490e63e950404e5ea47c89171a694329f3392cbdaa581a0f59791426b5417dce21&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT

GET

info
uipglob.semasio.net/adform/1/ Frame 75F8
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=379DA860-367D-482E-BB52-F3FEE924EE87&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=379DA860-367D-482E-BB52-F3FEE924EE87&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=379DA860-367D-482E-BB52-F3FEE924EE87
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=58b6dd6e-0487-43a4-94dd-0a35992da0b4
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=58b6dd6e-0487-43a4-94dd-0a35992da0b4
https://ib.adnxs.com/getuid?https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://sa.semasio.net/sync/1/4354957?sExtCookieId=5032325447999996024&sInitiator=internal&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://sa.semasio.net/sync/1/4354957?sExtCookieId=5032325447999996024&sInitiator=internal&gdpr=0&gdpr_consent=
https://track.adform.net/serving/cookie/match/?party=1008&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5962747737253797923&sInitiator=internal&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/16266044?sExtCookieId=5962747737253797923&gdpr=0&gdpr_consent=&sInitiator=internal
https://sync.srv.stackadapt.com/sync?nid=semasio
https://sg.semasio.net/sync/1/30805874?$sType=sync&sInitiator=internal&sExtCookieId=pbPfB3KrX-BhtlSRRWM4b2ds52s&gdpr=&gdpr_consent=
https://pixel.mathtag.com/sync/img?mt_exid=10041&redir=https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F14876172%3FsExtCookieId%3D%5BMM_UUID%5D%26sInitiator%3Dinternal&gdpr=&gdpr_consent=
https://sa.semasio.net/sync/1/14876172?sExtCookieId=a9f1682e-835e-4d00-80bf-a9b10fb938b1&sInitiator=internal&gdpr=&gdpr_consent=
https://pixel.mathtag.com/sync/img?mt_exid=10041&redir=https%3A%2F%2Fsa.semasio.net%2Fsync%2F1%2F14876172%3FsExtCookieId%3D%5BMM_UUID%5D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://sa.semasio.net/sync/1/14876172?sExtCookieId=a9f1682e-835e-4d00-80bf-a9b10fb938b1&sInitiator=internal&gdpr=0&gdpr_consent=
https://track.adform.net/serving/cookie/match/?party=1008&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/adform/1/info?sType=sync&sExtCookieId=5962747737253797923&sInitiator=internal&gdpr=0&gdpr_consent=

0
0

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 75F8 49 B
222 B 302ms
104ms Image
image/gif 52.220.144.146
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=379DA860-367D-482E-BB52-F3FEE924EE87&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.220.144.146 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-220-144-146.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 75F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Mzc5REE4NjAtMzY3RC00ODJFLUJCNTItRjNGRUU5MjRFRTg3&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1

42 B
97 B

247ms
97ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 75F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=N52oYDZ9SC67UvP-6STuhw%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEHa5fXv5s3BbUeshwggSLOc&google_cver=1

20 KB
20 KB

94ms
93ms

Image
text/html

23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEHa5fXv5s3BbUeshwggSLOc&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=164455
content-encoding: gzip
expires: Fri, 23 May 2025 23:33:25 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 22 May 2025 01:52:30 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEHa5fXv5s3BbUeshwggSLOc&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 75F8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1

42 B
529 B

146ms
97ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEISTXREh3p3Tjg8gX0ghA3U&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 75F8
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:682A23FB6FB6495CA110FA1ACA762A49

42 B
283 B

302ms
96ms

Image
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:682A23FB6FB6495CA110FA1ACA762A49
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:682A23FB6FB6495CA110FA1ACA762A49
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 21 May 2025 01:52:30 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2 200 379DA860-367D-482E-BB52-F3FEE924EE87
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 75F8 43 B
519 B 161ms
106ms Image
image/gif 2406:da18:929:5a01:64c8:d37f:b7df:45bb
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/379DA860-367D-482E-BB52-F3FEE924EE87?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2406:da18:929:5a01:64c8:d37f:b7df:45bb Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 366ms
314ms Image
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=f74364bd-ed96-472e-9f44-28a8ceeb0bd9&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=sdgwsq.partysballoons.com.au&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=df951b7b-73ef-4347-93ad-a03195ca6178&ccuid=27b1aa74-fc51-4bf6-9e7b-c5da0302cffd&sid=5c12775f-fa49-4fe5-b4db-45734bec99b5&nct=1747878749000&r=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&ns=true&lang=en-AU&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&devicefp=103.108.231.107%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=dbe96eb3-3543-49ad-925c-b4c7727a23af&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 22 May 2025 01:52:30 GMT
content-length: 0

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 7641 43 B
479 B 737ms
311ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=openx.com&id=fb3a36ae-7c97-c97e-030a-b0205eb52763

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: SMDFVTN2HCVREXN0BTVR
Content-Length: 43
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7641
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1

43 B
61 B

173ms
172ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 7641 170 B
243 B 898ms
392ms Image
image/png 142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OGY4Mzk5MTktYTk0YS0yYzIwLWQ2ZTQtNjgwZWZjNjQyMmUz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 7641
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEojQ

43 B
97 B

172ms
171ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEojQ
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEojQ
pragma: no-cache
via: 1.1 00625c2aa02f6876cd9570486ac98924.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: qkJ6WNIs0MgQaxz1l14ULI-I84RcMgC6SWlzsBogMel1Cvm2hTq8qA==
date: Thu, 22 May 2025 01:52:30 GMT
x-amz-cf-pop: SYD3-P2

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 7641
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ204AAAAA

43 B
136 B

253ms
175ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ204AAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: private
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ204AAAAA
X-SO-LB-Hostname: m-tgng23.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.107","key":"aC6DXsCo8XsAACUZ204AAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad363"}
X-SO-Cluster-ID: 0
X-SO-Upstream-ID: m-ad363
X-SO-HostName: m-ad363.dc4p.scaleout.jp
Connection: keep-alive
X-SO-IP: 103.108.231.107
X-SO-Key: aC6DXsCo8XsAACUZ204AAAAA
Content-Length: 0
P3P: CP="See also http://www.scaleout.jp/privacy/"
Date: Thu, 22 May 2025 01:52:30 GMT
X-SO-Ads-Time: 1
Server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7641
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=a3ec4ad3-603d-7284-c304-32b73686ec83&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=a3ec4ad3-603d-7284-c304-32b73686ec83&gdpr=0&gdpr_consent=

43 B
62 B

176ms
174ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=a3ec4ad3-603d-7284-c304-32b73686ec83&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=e818ca1e-0c23-caa8-0dd3-096b0ada08b7&ph=2d1251ae-7f3a-47cf-bd2a-2f288854a0ba&plm=5&r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dopenx.com%26id%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=a3ec4ad3-603d-7284-c304-32b73686ec83&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 22 May 2025 01:52:29 GMT
server: Kestrel

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B2B2 44 KB
11 KB 105ms
103ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: dc802dc98fc45961c3def33e97a7955e843c018fd65600ac10e1c8ed8887a95f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum

Response headers

cache-control: max-age=54391
content-encoding: gzip
expires: Thu, 22 May 2025 16:59:00 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11386
date: Thu, 22 May 2025 01:52:29 GMT
last-modified: Wed, 21 May 2025 16:59:00 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 98B0 44 KB
0 108ms
108ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-west&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: dc802dc98fc45961c3def33e97a7955e843c018fd65600ac10e1c8ed8887a95f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-west&p=rise_engage

Response headers

cache-control: max-age=54391
content-encoding: gzip
expires: Thu, 22 May 2025 16:59:00 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11386
date: Thu, 22 May 2025 01:52:29 GMT
last-modified: Wed, 21 May 2025 16:59:00 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 setuid
prebid.intergient.com/ Frame 84C6 0
876 B 301ms
300ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=b4b81ca9-5da6-42ea-9122-4d35da4f4b15
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878750&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=RMGCaqzy5D0go%2B%2FsdCsvdU0iJuzU4X7%2BLNdAgLMczHU%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878750&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=RMGCaqzy5D0go%2B%2FsdCsvdU0iJuzU4X7%2BLNdAgLMczHU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9438acab3b56865f-PER
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1

43 B
61 B

172ms
171ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEIDASS_Gn85pP47lfXxl3_I&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 84C6 170 B
232 B 791ms
398ms Image
image/png 142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTEwOTQwYWMtMmQ0ZS0yZmE3LWVmNGUtZDc5OTkxZjY0N2Y4

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
jp-u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://cr-p3.ladsp.com/cookiesender/3
https://cr-p3.ladsp.com/cookiesender/3?cr=true
https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEpVQ

43 B
61 B

170ms
170ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEpVQ
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://jp-u.openx.net/w/1.0/sd?id=537072451&val=AcDPTvNppOUJks8AKGbGfXY_v88AAAGW9bEpVQ
pragma: no-cache
via: 1.1 00625c2aa02f6876cd9570486ac98924.cloudfront.net (CloudFront)
expires: -1
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: UzdZh0bMT-JbnqrWf5eMwtry58Yc-kGWoeOxStrHiDZUQ_dV82dlZw==
date: Thu, 22 May 2025 01:52:30 GMT
x-amz-cf-pop: SYD3-P2

GET
H2

200

sd
jp-u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://tg.socdm.com/rtb/sync_before?proto=openx
https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ23YAAAAA

43 B
97 B

172ms
172ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ23YAAAAA
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: private
Location: https://jp-u.openx.net/w/1.0/sd?id=537072335&val=aC6DXsCo8XsAACUZ23YAAAAA
X-SO-LB-Hostname: m-tgng23.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/rtb\/sync_before?proto=openx","cluster_id":0,"gdpr":false,"ipv4":"103.108.231.107","key":"aC6DXsCo8XsAACUZ23YAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad253"}
X-SO-Cluster-ID: 0
X-SO-Upstream-ID: m-ad253
X-SO-HostName: m-ad253.dc4p.scaleout.jp
Connection: keep-alive
X-SO-IP: 103.108.231.107
X-SO-Key: aC6DXsCo8XsAACUZ23YAAAAA
Content-Length: 0
P3P: CP="See also http://www.scaleout.jp/privacy/"
Date: Thu, 22 May 2025 01:52:30 GMT
X-SO-Ads-Time: 1
Server: nginx

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=8d669366-e439-7103-faae-8d205b148998&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=8d669366-e439-7103-faae-8d205b148998&gdpr=0&gdpr_consent=

43 B
62 B

172ms
172ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=8d669366-e439-7103-faae-8d205b148998&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:29 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=8d669366-e439-7103-faae-8d205b148998&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 22 May 2025 01:52:29 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 84C6
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8423308747176845506&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

174ms
174ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8423308747176845506&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 103.108.231.107
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: image/gif
vary: Accept

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8423308747176845506&gdpr=0&gdpr_consent=&us_privacy=
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Connection: keep-alive

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 337ms
336ms XHR
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

c10f03a5f00e68cd5723e25583fea667475d30f05727657a6e5f0511408046af

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/json
vary: Origin

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 98B0 7 B
1 KB 451ms
98ms XHR
application/json 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B2B2 7 B
1 KB 548ms
100ms XHR
application/json 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c80248407eff6cf595ce43a76c04e23f
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 AGSKWxUFFJUOKOu8m7GFMb_IlRRaQmgqYAneTUgk3JvGXJalKb_ijcKCALGXS2OzTaoQ9yX0pB0isN4u1dqqHxUzI7sQA6AJHbwdX4Q1yGgnJ0prUoNhNKuunb0ua4wkt6wk_2KgzoA-7Q== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 422ms
420ms Script
application/javascript 2800:3f0:4005:406::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUFFJUOKOu8m7GFMb_IlRRaQmgqYAneTUgk3JvGXJalKb_ijcKCALGXS2OzTaoQ9yX0pB0isN4u1dqqHxUzI7sQA6AJHbwdX4Q1yGgnJ0prUoNhNKuunb0ua4wkt6wk_2KgzoA-7Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODc4NzUwLDMzMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJvYUs3YUZvX2YtVSJdLFs5LCJlbi1HQiJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzZGd3c3EucGFydHlzYmFsbG9vbnMuY29tLmF1Il0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.oaK7aFo_f-U.es5.O/d=1/rs=AJlcJMwRjfQquch2XBOAKw7IoCcozaVYqQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2800:3f0:4005:406::200e , Argentina, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

663f1d5852de41788554b5434e9071ee47540c165fb3ccb97a679371528a8126

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Xv6AhVHuLlTWMYrw05BsHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmII0JBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wZrEfpO1CIhDHW-yxoJw2k3WVCDetfEW6yEgbtK-zdoFxGZ-t1ntgFiIh-Ne266DbAIvbv7vYVLSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTA1MtAzMIgvMAAAHilDrg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Xv6AhVHuLlTWMYrw05BsHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 19D9 102 KB
28 KB 963ms
327ms Document
text/html 142.251.133.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.133.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 775
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 01:39:36 GMT
expires: Thu, 22 May 2025 02:29:36 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 338ms
98ms Script
application/javascript 2600:9000:277c:a000:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:277c:a000:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 873
x-cache: Hit from cloudfront
x-amz-cf-id: iqBxT3czYKE_xogJiQ9-USrRB8bK4wN80jTVDz_QV02sCelzwnwk0w==
date: Thu, 22 May 2025 01:37:58 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 2bff6bbbee7da79c98259baccec11e2c.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: SYD3-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 276ms
88ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 524359
x-goog-stored-content-encoding: gzip
expires: Sat, 16 May 2026 00:13:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Fri, 16 May 2025 00:13:11 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwpKQ53n5pWgxH3FqMBWFHs1jqpvnEmPe3LY6eCiQrOZaoqWK7JG_cGCyh6UvHZ5k64
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 578ms
390ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 7aee7f49992606aeb90fcca62802c639

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 169ms
60ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 520259
cf-ray: 9438acae7f178acd-PER
expires: Sun, 25 May 2025 01:52:30 GMT
date: Thu, 22 May 2025 01:52:30 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 454ms
164ms Script
text/javascript 2406:2600:7:100::2d
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::2d , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 23 May 2025 01:52:30 GMT
access-control-allow-origin: *
date: Thu, 22 May 2025 01:52:30 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*iULphTGZrpAQLzmQw73eOHkRlGfSRCNxyHC4itGS7lscK3sGNjtAYRUxONcWL0h7&gdpr_consent=undefined&gdpr=false
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttl=%%TTL%%
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F112%2F6%2F3.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/112/6/3.gif?puid=347212294327A5D5&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/5/4.gif?puid=9ae7393c-217e-47c4-89bf-c142bb4cb521&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F10%2F4%2F5.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/10/4/5.gif?puid=5962747737253797923&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/3/6.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/3/6.gif?puid=5032325447999996024&gdpr=0&gdpr_consent=
https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F821%2F2%2F7.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/821/2/7.gif?puid=8da67442-7cd1-431a-971c-57998c186ef4&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAF9a07QXQcAABtQeK9eUw&id5AccountNum=155&numCascadesAllowed=9
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=MzQ3MjEyMjk0MzI3QTVENQ%3D%3D&gdpr=0&gdpr_consent=&id5=ID5-1ec8ib4kLagIsy17mlSFwTYe2mpjqcxwVzI3abVk5g
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEKGGVHZQJsihEaA6LOiuWqQ&sInitiator=internal&google_cver=1&gdpr=0&gdpr_consent=&id5=ID5-1ec8ib4kLagIsy17mlSFwTYe2mpjqcxwVzI3abVk5g&...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8

70 B
428 B

90ms
90ms

Image
image/gif

35.71.131.137
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 70
date: Thu, 22 May 2025 01:52:37 GMT
content-type: image/gif
server: Kestrel

Redirect headers

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
Routing-Server-ID: -1
Frontend-ID: 1
Pragma: no-cache
Connection: keep-alive
Expires: Sat, 01 Jan 2011 12:00:00 GMT
Access-Control-Allow-Origin: *
Content-Length: 0
UIP-Response-Status: Ok
Date: Thu, 22 May 2025 01:52:37 GMT
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame DD54 20 KB
7 KB 95ms
95ms Document
text/html 23.221.132.242
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.132.242 Rehovot, Israel, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-132-242.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=164455
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 01:52:30 GMT
expires: Fri, 23 May 2025 23:33:25 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame 98B0
Redirect Chain

https://pixel-us-west.rubiconproject.com/exchange/sync.php?p=rise_engage&khaos=MAYPVL4D-F-5LA8
https://cs.yellowblue.io/cs?aid=11590&id=MAYPVL4D-F-5LA8

0
355 B

239ms
239ms

Image
application/javascript

54.212.176.45
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=MAYPVL4D-F-5LA8
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.212.176.45 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-212-176-45.us-west-2.compute.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://eus.rubiconproject.com/
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cs.yellowblue.io/cs?aid=11590&id=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 5daa34953a867809056448757b76591b
content-length: 0
Content-Type: text/html

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame B2B2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=MAYPVL4D-F-5LA8
https://usersync.gumgum.com/usersync?b=mag&i=MAYPVL4D-F-5LA8

35 B
250 B

104ms
102ms

Image
image/gif

52.77.73.106
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=mag&i=MAYPVL4D-F-5LA8
Requested by: Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D
Protocol: HTTP/1.1
Server: 52.77.73.106 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-77-73-106.ap-southeast-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: private, no-store, must-revalidate, max-age=0
Content-Length: 35
Date: Thu, 22 May 2025 01:52:30 GMT
Pragma: no-cache
Content-Type: image/gif
Connection: keep-alive

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://usersync.gumgum.com/usersync?b=mag&i=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 550b0c1400f70e56269f7c1848fb3166
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 98B0
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/dotNzsPlhLZ9QfxMWD6GxQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tEkGd0JE2oKiUF0MN4PHwRVoGQqY1AO_AeudWQ--~A

42 B
1 KB

216ms
97ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tEkGd0JE2oKiUF0MN4PHwRVoGQqY1AO_AeudWQ--~A
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 808ed95536e7f55d8adbcb9fc76d309d
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-tEkGd0JE2oKiUF0MN4PHwRVoGQqY1AO_AeudWQ--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 98B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGOAzDeLasEQeKhrhP8cKUI&google_cver=1

42 B
1 KB

99ms
98ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGOAzDeLasEQeKhrhP8cKUI&google_cver=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEGOAzDeLasEQeKhrhP8cKUI&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Thu, 22 May 2025 01:52:30 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 98B0
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTVkODQwODc3ZDI5ODNkNzU2MTlkYzkxZDQyOTg2ODdhMTM3NTlhYg

170 B
232 B

395ms
394ms

Image
image/png

142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTVkODQwODc3ZDI5ODNkNzU2MTlkYzkxZDQyOTg2ODdhMTM3NTlhYg

Requested by

Protocol

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YTVkODQwODc3ZDI5ODNkNzU2MTlkYzkxZDQyOTg2ODdhMTM3NTlhYg
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d264e84c9dc1a645a3048554992c5d82
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 98B0
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=58b6dd6e-0487-43a4-94dd-0a35992da0b4&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

279ms
97ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=58b6dd6e-0487-43a4-94dd-0a35992da0b4&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0ed95c36ed1932be3ba76fc523a6e179
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=58b6dd6e-0487-43a4-94dd-0a35992da0b4&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 22 May 2025 01:52:30 GMT
server: Kestrel

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok

43 B
479 B

311ms
310ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 2Y14E6Z1DGQSH35R2VSB
Content-Length: 43
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MAYPVL4D-F-5LA8&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: beb52df1a5a4b2f2cb3f37642c514298
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 98B0 43 B
855 B 312ms
309ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 6JTA503G7510W7SG32GS
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 22 May 2025 01:52:30 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 98B0
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUFZUFZMNEQtRi01TEE4
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFaCaBYOlIJ-cvumaeuvD4k&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUFZUFZMNEQtRi01TEE4&google_push=

170 B
188 B

396ms
396ms

Image
image/png

142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUFZUFZMNEQtRi01TEE4&google_push=

Requested by

Protocol

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUFZUFZMNEQtRi01TEE4&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: c80248407eff6cf595ce43a76c04e23f
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame 98B0 43 B
855 B 1051ms
407ms Image
image/gif 52.95.115.255
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.95.115.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: K3Q6JBPVZ2P1R8M3FK7P
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 98B0
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MAYPVL4D-F-5LA8

0
515 B

481ms
324ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MAYPVL4D-F-5LA8
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: F3521961D0BD4B12924E9FA6217A344B Ref B: PER311000106047 Ref C: 2025-05-22T01:52:31Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1r7wVtBKPVJUwn7AOBQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MAYPVL4D-F-5LA8
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 94869a3d6d62a785bc2a9351b08a70bb
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 98B0
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAF9a07QXQcAABtQeK9eUw&expires=30

42 B
1 KB

205ms
99ms

Image
image/gif

69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAF9a07QXQcAABtQeK9eUw&expires=30
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cc2b9026541f49c9c095b4cedfcedb9a
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAF9a07QXQcAABtQeK9eUw&expires=30
Content-Length: 0
Date: Thu, 22 May 2025 01:52:30 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

pixel
capi.connatix.com/us/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=MAYPVL4D-F-5LA8&pId=11&gdpr=&gdpr_consent=&us_privacy=

0
329 B

211ms
83ms

Image
text/plain

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MAYPVL4D-F-5LA8&pId=11&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 9438acb30c71ed7b-ADL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MAYPVL4D-F-5LA8&pId=11&gdpr=&gdpr_consent=&us_privacy=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 7d5ff5cea86970f029093dfe0a29d015
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
pbs.yahoo.com/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange
https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8

0
457 B

453ms
204ms

Image
text/html

2406:6e00:f048:1fa::3000
YAHOO-1

General

Check archive.org

Download Go to Show image

Full URL

https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8

Requested by

Protocol

Server

2406:6e00:f048:1fa::3000 Sydney, Australia, ASN10310 (YAHOO-1, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-envoy-upstream-service-time: 0
age: 0
x-envoy-decorator-operation: pbs--production-asse1.mediaplatform-gcp-prod-monetization.svc.cluster.local:4080/*
referrer-policy: no-referrer-when-downgrade
expires: 0
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html
vary: Origin,Accept-Encoding
server: ATS

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4b9b5fe4fdc8ed94e0f7cdc225df187a
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8

43 B
1 KB

275ms
273ms

Image
image/gif

103.43.91.51
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8

Requested by

Protocol

Server

103.43.91.51 Singapore, Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 9372a6a2-2f1e-45a7-841c-03befd7add7c
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: da1c8a4a3f9301c03fbeb7a6212a0a54
content-length: 0
Content-Type: text/html

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://sync.a-mo.net/setuid/magnite?uid=MAYPVL4D-F-5LA8

0
720 B

293ms
97ms

Image
text/plain

131.153.206.103
PHOENIXNAP-AS-SG1...

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MAYPVL4D-F-5LA8
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 131.153.206.103 , United States, ASN59210 (PHOENIXNAP-AS-SG1 PhoenixNAP, SG),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Thu, 22 May 2025 01:52:31 GMT
x-envoy-upstream-service-time: 2
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 38ddff6a66d3988dfd0c6ea3be81c5f1
content-length: 0
Content-Type: text/html

GET

v1
match.sharethrough.com/sync/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MAYPVL4D-F-5LA8

0
0

GET
H2

200

merge
ce.lijit.com/ Frame 98B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=MAYPVL4D-F-5LA8

43 B
501 B

742ms
250ms

Image
image/gif

35.82.234.128
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=MAYPVL4D-F-5LA8
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 35.82.234.128 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-82-234-128.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ce.lijit.com/merge?pid=80&3pid=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
content-length: 0
Content-Type: text/html

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 9543
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

269 B
379 B

98ms
96ms

Document
text/html

184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 01:52:30 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
server: AkamaiGHost

GET
H/1.1 200
OK ecm3
s.amazon-adsystem.com/ Frame 2ED4 43 B
479 B 309ms
308ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=inmobi.com&id=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59

Requested by

Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: C66NYKKXF641XCPAAQBQ
Content-Length: 43
Date: Thu, 22 May 2025 01:52:31 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2ED4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_new_eb&google_cm
https://sync.inmobi.com/gob?google_gid=CAESEBmOYmrl2foNYZUDSjV2i3A&google_cver=1
https://sync.inmobi.com/sync?redirect=&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=3&google_push=&retry=
https://cm.g.doubleclick.net/pixel?google_hm=pyQmCmE0J_wJjhlZRuc0&google_push=&google_nid=inmobi_new_eb

170 B
188 B

396ms
395ms

Image
image/png

142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=pyQmCmE0J_wJjhlZRuc0&google_push=&google_nid=inmobi_new_eb

Requested by

Protocol

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:32 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
location: https://cm.g.doubleclick.net/pixel?google_hm=pyQmCmE0J_wJjhlZRuc0&google_push=&google_nid=inmobi_new_eb
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2 200 setuid
s2s.yieldlove-ad-serving.net/ Frame 2ED4 86 B
439 B 978ms
315ms Image
image/png 3.126.218.248
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://s2s.yieldlove-ad-serving.net/setuid?bidder=inmobi&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.126.218.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-218-248.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

expires: 0
cache-control: no-cache, no-store, must-revalidate
content-length: 86
date: Thu, 22 May 2025 01:52:31 GMT
pragma: no-cache
content-type: image/png
vary: Accept-Encoding, Origin

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 2ED4 170 B
232 B 396ms
394ms Image
image/png 142.251.132.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=pyQmCmE0J_wJjhlZRuc0&gdpr_consent=&gdpr=&google_nid=inmobi_dbm

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.132.98 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2ED4 0
0

GET usync.html
eus.rubiconproject.com/ Frame 2ED4 0
0

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://ib.adnxs.com/getuid?https://sync.inmobi.com/setuid?bidderID=32&dspUserId=$UID
https://sync.inmobi.com/setuid?bidderID=32&dspUserId=5032325447999996024

0
17 B

293ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=32&dspUserId=5032325447999996024
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.inmobi.com/setuid?bidderID=32&dspUserId=5032325447999996024
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: b9d19ecc-2ad3-463b-8a29-ca3bb64f6dfb
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://x.bidswitch.net/sync?ssp=aerserv&user_id=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&gdpr=&gdpr_pd=&gdpr_consent=&us_privacy=&expires=30
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=aerserv&bsw_param=4856bb54-744d-4456-ab03-cb5400f9496c&google_hm=NDg1NmJiNTQtNzQ0ZC00NDU2LWFiMDMtY2I1NDAwZjk0OTZj...
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEHjC8z0hmQTrhhx56bmt-Cs&google_cver=1&ssp=aerserv&bsw_param=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr_consent=&gdpr=
https://sync.inmobi.com/setuid?bidderID=128&dspUserId=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=

0
17 B

294ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=128&dspUserId=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //sync.inmobi.com/setuid?bidderID=128&dspUserId=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:31 GMT

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3535&partner_device_id=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26dspUserI...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3535&partner_device_id=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&partner_url=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D877%26ds...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%252Chttps%25253A%25252F%25252Fsync.inmobi.com%25252Fsetuid%25253FbidderID%25253D877%...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%2Chttps%253A%252F%252Fsync.inmobi.com%...
https://sync.inmobi.com/setuid?bidderID=877&dspUserId=9ae7393c-217e-47c4-89bf-c142bb4cb521

0
17 B

294ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=877&dspUserId=9ae7393c-217e-47c4-89bf-c142bb4cb521
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

strict-transport-security: max-age=31536000
location: https://sync.inmobi.com/setuid?bidderID=877&dspUserId=9ae7393c-217e-47c4-89bf-c142bb4cb521
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
server: Jetty(11.0.25)

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=g6nxmp9&ttd_tpi=1&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=21&dspUserId=58b6dd6e-0487-43a4-94dd-0a35992da0b4

0
40 B

295ms
294ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=21&dspUserId=58b6dd6e-0487-43a4-94dd-0a35992da0b4
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=21&dspUserId=58b6dd6e-0487-43a4-94dd-0a35992da0b4
content-length: 209
date: Thu, 22 May 2025 01:52:31 GMT
server: Kestrel

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://b1sync.zemanta.com/usersync/inmobi/?puid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&us_...
https://b1sync.outbrain.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&puid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&s=...
https://b1sync.zemanta.com/usersync/inmobi/?cb=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D210%26dspUserId%3D__ZUID__&gdpr=&gdpr_consent=&obuid=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4&puid=ID5...
https://sync.inmobi.com/setuid?bidderID=210&dspUserId=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4

0
17 B

293ms
292ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=210&dspUserId=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=210&dspUserId=1a9101ca-c30c-4cf2-aba5-7e808c62d1a4
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 117
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html; charset=utf-8

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=157097&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D157097%26mpc%3D4%26fp%3D1%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=58b6dd6e-0487-43a4-94dd-0a35992da0b4&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8423308747176845506&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?fp=1&gdpr=0&mpc=4&p=157097&pmc=1&pr=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D76%26dspUserId%3D379DA860-367D-482E-BB52-F3FEE924EE87
https://sync.inmobi.com/setuid?bidderID=76&dspUserId=379DA860-367D-482E-BB52-F3FEE924EE87

0
17 B

293ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=76&dspUserId=379DA860-367D-482E-BB52-F3FEE924EE87
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.inmobi.com/setuid?bidderID=76&dspUserId=379DA860-367D-482E-BB52-F3FEE924EE87
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:32 GMT
server: nginx

GET
H2 200 159
match.deepintent.com/usersync/ Frame 2ED4 0
39 B 300ms
298ms Image
text/plain 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/159
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

date: Thu, 22 May 2025 01:52:31 GMT
server: b
content-length: 0

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://sync.e-volution.ai/a184e2218ea9f18e32c70fb304405e72.gif?puid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D957%26dspUserId%3D%5BUID%5D...
https://sync.inmobi.com/setuid?bidderID=957&dspUserId=624fe179-bb25-4638-ac5c-2bc004e59698

0
17 B

294ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=957&dspUserId=624fe179-bb25-4638-ac5c-2bc004e59698
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=957&dspUserId=624fe179-bb25-4638-ac5c-2bc004e59698
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 0
Date: Thu, 22 May 2025 01:52:31 GMT
Server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&nuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59
https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=b90f6795b2b0a70&is_secure=true&networkId=98193&version=1&nuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59
https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACtFFam2AWVQIj4g5gAQEBAQEBAQCX9LAvHgEBAQEBAQEB&expiration=1747965151&nuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&is_secure=true

0
17 B

296ms
295ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACtFFam2AWVQIj4g5gAQEBAQEBAQCX9LAvHgEBAQEBAQEB&expiration=1747965151&nuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&is_secure=true
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://sync.inmobi.com/setuid?bidderID=24&dspUserId=AQACtFFam2AWVQIj4g5gAQEBAQEBAQCX9LAvHgEBAQEBAQEB&expiration=1747965151&nuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&is_secure=true
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
pragma: no-cache
server: nginx

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 2ED4
Redirect Chain

https://s.ad.smaato.net/c/?dspInit=1001980&dspCookie=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&gdpr=&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=3372&partner_device_id=89c24f0474
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%2C%2C

95 B
124 B

219ms
219ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 22 May 2025 01:52:32 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=58b6dd6e-0487-43a4-94dd-0a35992da0b4&ttd_puid=9ae7393c-217e-47c4-89bf-c142bb4cb521%2C%2C
content-length: 359
date: Thu, 22 May 2025 01:52:32 GMT
server: Kestrel

GET
H2

500

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://id.rlcdn.com/713074.gif?
https://sync.inmobi.com/setuid?bidderID=97&dspUserId=

60 B
60 B

294ms
294ms

Image
image/avif

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: a6642f816880217435423f2ae3bc4af4cdfb0ef852c20563e304eff8b79f025a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 60
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/avif;charset=UTF-8
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://sync.inmobi.com/setuid?bidderID=97&dspUserId=
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://us.ck-ie.com/inmslw82.gif?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3DID5-893%26dspUserId%3D%7B%24PARTNER_UID%7D
https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=bfef1ffb556f2ae5797668137b41f955735112b57cc29bdeada46f0f7187c23f

0
17 B

296ms
296ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=bfef1ffb556f2ae5797668137b41f955735112b57cc29bdeada46f0f7187c23f
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Transfer-Encoding: chunked
Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=ID5-893&dspUserId=bfef1ffb556f2ae5797668137b41f955735112b57cc29bdeada46f0f7187c23f
Pragma: no-cache
Connection: keep-alive
Expires: 0
Date: Thu, 22 May 2025 01:52:32 GMT
Server: nginx

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=inmobi&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=82&dspUserId=7982c9f12a

0
17 B

294ms
294ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=7982c9f12a
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=82&dspUserId=7982c9f12a
content-length: 5
date: Thu, 22 May 2025 01:52:32 GMT
content-type: text/plain; charset=utf-8

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://cs.playdigo.com/dd3f91b3168664e47ebd1aec9512abd4.gif?puid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1302%26dspUserId%3D%5BUID%5D&g...
https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=f6955da5-c571-4520-8176-2230e9887b98

0
17 B

300ms
299ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=f6955da5-c571-4520-8176-2230e9887b98
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Location: https://sync.inmobi.com/setuid?bidderID=1302&dspUserId=f6955da5-c571-4520-8176-2230e9887b98
Pragma: no-cache
Connection: keep-alive
Expires: 0
Keep-Alive: timeout=5
Content-Length: 0
Date: Thu, 22 May 2025 01:52:32 GMT

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://tracker-shr.ortb.net/sync?id=1&uid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59
https://sync.inmobi.com/setuid?bidderID=276&dspUserId=b07af7cf-b873-faf9-b10e-c4033cd820ca

0
17 B

300ms
298ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=276&dspUserId=b07af7cf-b873-faf9-b10e-c4033cd820ca
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

access-control-max-age: 3600
location: https://sync.inmobi.com/setuid?bidderID=276&dspUserId=b07af7cf-b873-faf9-b10e-c4033cd820ca
access-control-allow-credentials: true
access-control-allow-methods: GET, DELETE, OPTIONS, POST, PUT, PATCH
permissions-policy: browsing-topics=()
access-control-allow-origin: *
content-length: 106
content-type: text/plain; charset=utf-8
access-control-allow-headers: *

GET
H2 200 sync
ittpx.eskimi.com/ Frame 2ED4 43 B
178 B 826ms
272ms Image
image/gif 188.40.16.220
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL: https://ittpx.eskimi.com/sync?sp_id=64&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 188.40.16.220 , Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),
Reverse DNS: static.220.16.40.188.clients.your-server.de
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

date: Thu, 22 May 2025 01:52:32 GMT
content-type: image/gif
x-empty-response-reason: Disabled country (au: 103.108.231.107)

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=138&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=238&dspUserId=pbPfB3KrX-BhtlSRRWM4b2ds52s

0
17 B

296ms
295ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=238&dspUserId=pbPfB3KrX-BhtlSRRWM4b2ds52s
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Location: https://sync.inmobi.com/setuid?bidderID=238&dspUserId=pbPfB3KrX-BhtlSRRWM4b2ds52s
Content-Length: 108
Date: Thu, 22 May 2025 01:52:32 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://tr.blismedia.com/v1/api/sync/inmobi?gdpr_consent=&gdpr=
https://sync.inmobi.com/setuid?bidderID=94&dspUserId=682E835DE1571ABC2358019A_&gdpr=&gdpr_consent=

0
40 B

293ms
293ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=94&dspUserId=682E835DE1571ABC2358019A_&gdpr=&gdpr_consent=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://sync.inmobi.com/setuid?bidderID=94&dspUserId=682E835DE1571ABC2358019A_&gdpr=&gdpr_consent=
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://sync.clearnview.com/redirect?gdpr=&gdpr_consent=&usp_consent=&pubid=17&pubuid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D869%26d...
https://sync.inmobi.com/setuid?bidderID=869&dspUserId=dbd3d209-6fa4-58a2-856e-bb54bc7873c1

0
17 B

295ms
294ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=869&dspUserId=dbd3d209-6fa4-58a2-856e-bb54bc7873c1
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

Transfer-Encoding: chunked
Location: https://sync.inmobi.com/setuid?bidderID=869&dspUserId=dbd3d209-6fa4-58a2-856e-bb54bc7873c1
Keep-Alive: timeout=5
Date: Thu, 22 May 2025 01:52:33 GMT
Connection: keep-alive

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://csync.loopme.me/?pubid=9724&gdpr=&gdpr_consent=&redirect=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D109%26dspUserId%3D%7Bviewer_token%7D
https://sync.inmobi.com/setuid?bidderID=109&dspUserId=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=null

0
17 B

294ms
294ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=109&dspUserId=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=null
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=109&dspUserId=8da67442-7cd1-431a-971c-57998c186ef4&gdpr_consent=null&gdpr=null
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
server: _

GET 4831fbf13dd518a56346a6e0ec8ba9d5.gif
cs.krushmedia.com/ Frame 2ED4 0
0

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D13%26dspUserId%3D%24UID
https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Ks3wALZHDoIntLdTQECcC3rE

0
17 B

294ms
292ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Ks3wALZHDoIntLdTQECcC3rE
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

location: https://sync.inmobi.com/setuid?bidderID=13&dspUserId=Ks3wALZHDoIntLdTQECcC3rE
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://creativecdn.com/cm-notify?pi=inmobi&gdpr=&gdpr_consent=
https://sync.inmobi.com/setuid?bidderID=16&dspUserId=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=inmobi&gdpr=&gdpr_consent=

0
17 B

297ms
295ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=16&dspUserId=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=inmobi&gdpr=&gdpr_consent=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://sync.inmobi.com/setuid?bidderID=16&dspUserId=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=inmobi&gdpr=&gdpr_consent=
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT, Thu, 22 May 2025 01:52:33 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/inm
https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAF9a07QXQcAABtQeK9eUw

0
17 B

297ms
296ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAF9a07QXQcAABtQeK9eUw
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://sync.inmobi.com/setuid?bidderID=12&dspUserId=AAF9a07QXQcAABtQeK9eUw
Content-Length: 0
Date: Thu, 22 May 2025 01:52:33 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 400
Bad Request user-sync
sync.adkernel.com/ Frame 2ED4 22 B
22 B 297ms
97ms Image
text/plain 103.67.201.72
PHOENIXNAP-AS-SG1...

General

Check archive.org

Download Go to Show image

Full URL: https://sync.adkernel.com/user-sync?zone=147857&t=image&gdpr=&gdpr_consent=&r=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D1029%26dspUserId%3D%7BUID%7D
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 103.67.201.72 , United States, ASN59210 (PHOENIXNAP-AS-SG1 PhoenixNAP, SG),
Reverse DNS: 1.cpm.sin1.wowcon.net
Software: nginx /
Resource Hash: 4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

Cache-Control: no-store
Content-Length: 22
Date: Thu, 22 May 2025 01:52:33 GMT
Server: nginx
Connection: close

GET
H2 204 e03deca3316b700a1ce99c41e324fd03.gif
cs.admanmedia.com/ Frame 2ED4 0
41 B 1611ms
294ms Image
text/plain 80.77.87.163
NATCOWEB

General

Check archive.org

Download Go to Show image

Full URL: https://cs.admanmedia.com/e03deca3316b700a1ce99c41e324fd03.gif?puid=ID5-1-bcaa39d8-b0b6-48ec-9a85-7bd989c97b59&redir=https%3A%2F%2Fsync.inmobi.com%2Fsetuid%3FbidderID%3D149%26dspUserId%3D%5BUID%5D&gdpr=&gdpr_consent=
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 80.77.87.163 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

date: Thu, 22 May 2025 01:52:34 GMT
server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 2ED4
Redirect Chain

https://sync.1rx.io/usersync2/inmobi&gdpr=&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=3338923077
https://sync.1rx.io/usersync/tradedesk/58b6dd6e-0487-43a4-94dd-0a35992da0b4
https://sync.targeting.unrulymedia.com/csync/RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dunruly%26userId%3DRX-4c076cea-781f-4cdc-...
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004

43 B
496 B

310ms
309ms

Image
image/avif

137.184.70.213
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 137.184.70.213 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 01:52:34 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-4c076cea-781f-4cdc-b698-8f6b96eb1187-004
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 22 May 2025 01:52:34 GMT
etag: RX4c076cea781f4cdcb6988f6b96eb1187004
content-type: text/html

GET
H2

200

setuid
sync.inmobi.com/ Frame 2ED4
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub6871903319744&gdpr=&consent=&us_privacy=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=ec1ee158faecc4d&gdpr=&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub6871903319744
https://t.adx.opera.com/sync?vendor=60369&pubid=pub6871903319744
https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU57df70adc15c4db1b7b05e32fff3d23f

0
17 B

295ms
294ms

Image
text/plain

35.212.104.44
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU57df70adc15c4db1b7b05e32fff3d23f
Requested by: Host: sync.inmobi.com
URL: https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dinmobi.com%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us_privacy=&gdpr_pd=&source=1&google_push=&retry=true
Protocol: H2
Server: 35.212.104.44 Washington, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 44.104.212.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.inmobi.com/

Response headers

via: 1.1 google
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://sync.inmobi.com/setuid?bidderID=1135&dspUserId=OPU57df70adc15c4db1b7b05e32fff3d23f
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS
expires: Mon, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
content-length: 117
date: Thu, 22 May 2025 01:52:33 GMT
content-type: text/html; charset=utf-8
server: Tengine
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With

GET
H2 200 AGSKWxWUuKL_1UQKmgGGPuAcD06TiuegpDfhybBAPxeVhUsvL10NyHcVev3bn9Ha8jcHw3bwBaeE0OoWE-y9NKxI8Et4DAsfpDiSkSxGKqsjR9xuWh8lmim4GOHQlVbg_F-W4EMGTDk8Kw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 427ms
426ms Script
application/javascript 2800:3f0:4005:406::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWUuKL_1UQKmgGGPuAcD06TiuegpDfhybBAPxeVhUsvL10NyHcVev3bn9Ha8jcHw3bwBaeE0OoWE-y9NKxI8Et4DAsfpDiSkSxGKqsjR9xuWh8lmim4GOHQlVbg_F-W4EMGTDk8Kw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODc4NzUwLDg2MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwib2FLN2FGb19mLVUiXSxbOSwiZW4tR0IiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwic2Rnd3NxLnBhcnR5c2JhbGxvb25zLmNvbS5hdSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2800:3f0:4005:406::200e , Argentina, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

64d09d1565718abc5f05848bc762f3285b99087fb5849584f8f8fde1cd1be2cf

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Sv8_kHzA7otTut2FoRbNNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:31 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw0ZBiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wZrEfpO1CIhDHW-yxoJw2k3WVCDetfEW6yEgbtK-zdoFxGZ-t1ntgFiIm-N-266DbAIrVu1WV9JIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDUy0DMwiC8wAAC1bUKQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Sv8_kHzA7otTut2FoRbNNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame C5A5 16 KB
6 KB 306ms
102ms Document
text/html 2406:2600:7:100::9
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2406:2600:7:100::9 , Japan, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

43fe7cc6db1c3739aeb83e2496de0dd49feaf3aeee148bbb99f2aabd682f9347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 01:52:30 GMT
server: Kestrel
server-processing-duration-in-ticks: 547587
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 9543 44 KB
0 108ms
108ms Script
text/html 184.31.253.153
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.253.153 Seoul, Korea, Republic Of, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-253-153.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: dc802dc98fc45961c3def33e97a7955e843c018fd65600ac10e1c8ed8887a95f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=

Response headers

cache-control: max-age=54391
content-encoding: gzip
expires: Thu, 22 May 2025 16:59:00 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11386
date: Thu, 22 May 2025 01:52:29 GMT
last-modified: Wed, 21 May 2025 16:59:00 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
551 B 652ms
470ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: d514552f1137df9b62fdda8ce3ff5e761a5bde3470c3c4835fbc50f885515e31

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 285
date: Thu, 22 May 2025 01:52:31 GMT
content-type: application/json
x-cloud-trace-context: 63d437411f53947342427535bc548b70
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 47B0 2 KB
1 KB 119ms
118ms Document
text/html 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c4d845132f01c0896a200d1b686106664ea34a4ef2da8e5f4ff8dd1e46fe5e5

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9438acb28d8e8643-PER
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 01:52:31 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vjKa%2B9owDo6RWpLoxFbaocBBotmJLeaDuWAW2RhwYT0GAWW9%2FEwHtePbzuyzX5XGmSEqVfmk67dT7uQFs%2BVHnbiweILfKbBUPYZxlI9BTazUvqBbDQV7T7nj5NeoxXzoS8ye7u8fCnRQ%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aC6DXYsFVUEALJJFAK69igAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEnjjTijfa7OxT109k5TuCo&google_cver=1

43 B
768 B

118ms
117ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEnjjTijfa7OxT109k5TuCo&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ERv4n5N2Ulyf17aBUomKpu4P3Q00Sf%2B1%2B3OciaTM3G1ZXdmEuF8%2FGU9LVKBAh7nqlYwUCE%2FuTePmKr26dPXJ9LVRbcDukTZmRufbPRgKDFyG%2BX88wqG%2BFV4z0mDYAdoL43R1lJrWSkSQfA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb6b9958643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEnjjTijfa7OxT109k5TuCo&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 314
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=5032325447999996024

43 B
760 B

129ms
129ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=5032325447999996024
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ee7UoM5K50oczFkRjTHFnzkM2oam0dVqasZsg0h400q%2FU89oPfxbaIOnudgYBtlgWjKB%2B5NyoYysJRxN694kRzr3ck73Zd5q656ch01Z%2FTsmmLJbmbVAJswLm7X9SHs0Xo0zzZOoChZXdg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb538138643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=5032325447999996024
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8afe2c81-1543-4b9c-a8b0-4bb8d4d6f13a
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAF9a07QXQcAABtQeK9eUw&expiration=1749088351

43 B
764 B

119ms
119ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAF9a07QXQcAABtQeK9eUw&expiration=1749088351
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E2kMeX%2BNvV952tyP9n7oXMdSWVCEmWMCiH6OcGtH3MLAw743YSA4VNuT7YaLa4tdlxN7RHRkqi%2FI2jJAWk5mHUXvYjdwUroLKMlNDsvwtLl%2BEQuCjn4GF90lVw%2F7FkG7UaoA2a1gWSQutQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb49f5c8643-PER
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAF9a07QXQcAABtQeK9eUw&expiration=1749088351
Content-Length: 0
Date: Thu, 22 May 2025 01:52:31 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0
https://cms.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&__qcmcs=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=YRLUUm8Z01F6HYQAZRvLDmAb1QZ6HdMONh-Fzx1j

43 B
764 B

116ms
115ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=YRLUUm8Z01F6HYQAZRvLDmAb1QZ6HdMONh-Fzx1j
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Us%2BH1C9lLVD9vcew4yP2H%2BQWwun0kqEGFd%2BG2Nb9SpW9aouEELMkul3ZhEirbimCHSXLTmVmgKGQBFnVw1vx58w8PHoLG7A%2FI8UnvOY0MZ7ks7tyTxLvCo3oAueGXLZgEFN9qiom8hiBPA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb618ed8643-PER
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=YRLUUm8Z01F6HYQAZRvLDmAb1QZ6HdMONh-Fzx1j
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662135896860590

43 B
767 B

112ms
112ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662135896860590
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eEPbYb%2F8IN5OF4cdE3q4u07%2BDiGG1kKyQvESHyjkZp4Cu4Z9iRkoD90%2B4MNwMsvHoR16DJj4644yV5i9TaDQzv%2FWqvgOeRv%2B8QDzbVGhQCnQNmcex1EKrF7LMv5miAjKuzswySVq3LqQAw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:32 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb7baba8643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, private
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662135896860590
cf-cache-status: DYNAMIC
pragma: no-cache
x-function: 209
cf-ray: 9438acb5ec5a8655-PER
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-reuse-index: 303
p3p: CP="NOI DEVo TAIa OUR BUS"
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html
server: cloudflare
priority: u=3,i

GET
H2

200

crum
dsum.casalemedia.com/ Frame 47B0
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=5032325447999996024

43 B
537 B

116ms
109ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=5032325447999996024
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s82%2BNce4M0BA5PtPpJh7PeClqjl8cDGkYH7dWJob5oAUQLrkALOdXFKdWs1lcBfMl062dUPTJwAqzGUJJR2E6eddTRG%2FRv1R5%2BUzaDvZOwQAk9HD58OkuhKASzWGXMtgJynnkeYZ"}],"group":"cf-nel","max_age":604800}
cf-ray: 9438acb53c1d120c-PER
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=5032325447999996024
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d4b23d1f-ee9d-4810-abbf-f705a39b0395
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 01:52:31 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://cm.ctnsnet.com/int/cm?exc=19
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=6b80164b25cd4156bb50211aeee95b4b&expiration=1750470751

43 B
766 B

117ms
116ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=6b80164b25cd4156bb50211aeee95b4b&expiration=1750470751
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1MWLDC3aTizRDugnFAsH0AVOvfoswUnNsnuGFGpIHAezRDrcUXRSswx8hqEEKJSylvHb%2BGOQwehZvz3c0cdHoam2ZsJkHtDdkNSuO1uBaBSGIDG8T3n%2FmqnaQ%2FE%2FsyouQ4SoG%2BGpVW9TWw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb5f8cb8643-PER
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=109&external_user_id=6b80164b25cd4156bb50211aeee95b4b&expiration=1750470751
pragma: no-cache
via: 1.1 google
expires: Fri, 01 Jan 1990 00:00:00 GMT
status: 302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CUR OUR NOR"
content-length: 0
x-xss-protection: 1; mode=block
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html;charset=UTF-8

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 47B0
Redirect Chain

https://tr.blismedia.com/v1/api/sync/indexexchange?gdpr=&userId=aC6DXYsFVUEALJJFAK69igAA%264745&gpp=&gpp_sid=&us_privacy=&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=230&cb=&external_user_id=682E835DE1571ABC2358019A_&expiry=&gdpr=&gdpr_consent=&gpp=&gpp_sid=&us_privacy=

43 B
764 B

116ms
116ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=230&cb=&external_user_id=682E835DE1571ABC2358019A_&expiry=&gdpr=&gdpr_consent=&gpp=&gpp_sid=&us_privacy=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P7UG%2BxHSw%2Bn4b9i7mGBQ%2FTJo6lwBca6rG4175YJhdzfsjMfDt7nnkP7I9y9V1n8Vb4kQ4qooLex6QSy7EUbdigwbtHPfYpQgfSG1d1JigRFfpNxYF6i0yjcCvS%2Bni3L5i13Sf6BZZSjWaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 01:52:31 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9438acb49f5b8643-PER
content-length: 43
server: cloudflare

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=230&cb=&external_user_id=682E835DE1571ABC2358019A_&expiry=&gdpr=&gdpr_consent=&gpp=&gpp_sid=&us_privacy=
content-length: 0
date: Thu, 22 May 2025 01:52:31 GMT

GET
H3 200 setuid
prebid.intergient.com/ Frame 47B0 0
976 B 302ms
301ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aC6DXYsFVUEALJJFAK69igAA%264745
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878751&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=tNJyK%2Fnyk%2BXIF9KJ1z16nvprrw1J2Wdy7No4vooFz9Y%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878751&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=tNJyK%2Fnyk%2BXIF9KJ1z16nvprrw1J2Wdy7No4vooFz9Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9438acb38fbf865f-PER
server: cloudflare

GET
H2

200

sid Show response
mug.criteo.com/ Frame C5A5
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=3&topUrl=paint.toys&bundle=NN8S_V84QWJvNVI1JTJGSDhJaXVFVmFQbHVQRnFsNVpTUmFIbnF1UktmSng5WnptcnlLeGtnUyU...
https://mug.criteo.com/sid?cpp=TS6473xIbjhPOVkxemdLdlUwaGtzWHNobGh6bTZyNFpsS2hNT2JTTWVybEswUGQvSStuTnVsUGxkTHUrRS9nUTN0WmIwN3lZVDVyVEozUlkxUHZSZmovQmpZU1VMWWxDUnJ2WjczUkJaa0Rxd2sxcmhyNlo5dHRKVlJocX...

438 B
998 B

292ms
96ms

Fetch
application/json

182.161.73.136
CRITEO-AS-AP Crit...

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=TS6473xIbjhPOVkxemdLdlUwaGtzWHNobGh6bTZyNFpsS2hNT2JTTWVybEswUGQvSStuTnVsUGxkTHUrRS9nUTN0WmIwN3lZVDVyVEozUlkxUHZSZmovQmpZU1VMWWxDUnJ2WjczUkJaa0Rxd2sxcmhyNlo5dHRKVlJocXFnVmFUZHZKdDNtU3NXTDkwWnBKWHI0UitycFM1MmszREZHdmhpZDV6b3MwVkdtdTAxMmQzLzBzRzNoOGVJcjB4MjZ1ZU9IdnArL2x0R0VPS1FXS2I1SVBWL0JZRkU1SHVMT3dmbjFodGJRZ2orSFozaGc4QXRuMDAxTWpQZUt6WEhMUGZKczNxcnB5bXMyM002eUNnOUdiQTBvOG1HWHIwbzdvWXcrZ3MyT3NIbU9wY1dKL0trd1VFc2FYTEdKWG9uZi9zaW9rUzhiZVpYU1BkUzlSRUg4Ymo1U2dIcnc9PXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

182.161.73.136 , Singapore, ASN55569 (CRITEO-AS-AP Criteo APAC, JP),

Reverse DNS

Software

Kestrel /

Resource Hash

66b165089b88daf0b6f4aec6bcf05d81b6448ddf296aaa2e8dec714e39f6f493

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 665076
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Thu, 22 May 2025 01:52:31 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=TS6473xIbjhPOVkxemdLdlUwaGtzWHNobGh6bTZyNFpsS2hNT2JTTWVybEswUGQvSStuTnVsUGxkTHUrRS9nUTN0WmIwN3lZVDVyVEozUlkxUHZSZmovQmpZU1VMWWxDUnJ2WjczUkJaa0Rxd2sxcmhyNlo5dHRKVlJocXFnVmFUZHZKdDNtU3NXTDkwWnBKWHI0UitycFM1MmszREZHdmhpZDV6b3MwVkdtdTAxMmQzLzBzRzNoOGVJcjB4MjZ1ZU9IdnArL2x0R0VPS1FXS2I1SVBWL0JZRkU1SHVMT3dmbjFodGJRZ2orSFozaGc4QXRuMDAxTWpQZUt6WEhMUGZKczNxcnB5bXMyM002eUNnOUdiQTBvOG1HWHIwbzdvWXcrZ3MyT3NIbU9wY1dKL0trd1VFc2FYTEdKWG9uZi9zaW9rUzhiZVpYU1BkUzlSRUg4Ymo1U2dIcnc9PXw&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 279983
expires: 0
content-length: 0
date: Thu, 22 May 2025 01:52:30 GMT
server: Kestrel

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 9543 7 B
1 KB 98ms
97ms XHR
application/json 69.173.158.64
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?khaos=MAYPVL4D-F-5LA8
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.158.64 Singapore, Singapore, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 548ddf114c6f6bfbb66a4cdeb6a219f4
content-length: 7
content-type: application/json; charset=UTF-8

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 380ms
379ms Fetch
text/plain 2800:3f0:4005:411::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55k1v9101576445za200&_p=1747878745611&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=1917009361.1747878747&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1747878746&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.partysballoons.com.au%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=12&tfd=6963
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2800:3f0:4005:411::200e , Argentina, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:31 GMT
content-type: text/plain
server: Golfe2

GET
H3

200

setuid
prebid.intergient.com/ Frame 9543
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=&khaos=MAYPVL4D-F-5LA8
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8

0
1 KB

300ms
300ms

Image
text/html

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747878751&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=tNJyK%2Fnyk%2BXIF9KJ1z16nvprrw1J2Wdy7No4vooFz9Y%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 01:52:32 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747878751&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=tNJyK%2Fnyk%2BXIF9KJ1z16nvprrw1J2Wdy7No4vooFz9Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9438acb6b96d865f-PER
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MAYPVL4D-F-5LA8
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0d2bd05215470efb17ae41aff76c3f98
content-length: 0
Content-Type: text/html

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 75F8 0
260 B 292ms
95ms Script
text/plain 207.65.33.76
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.76 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:30 GMT
server: nginx

POST
H2 200 putRecords Show response
prod.tahoe-analytics.publishers.advertising.a2z.com/logevent/ 146 B
375 B 254ms
251ms Fetch
application/json 52.41.64.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.tahoe-analytics.publishers.advertising.a2z.com/logevent/putRecords?encoded=true
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.41.64.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-41-64-239.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: c264682839732751dfa702d8f5557d568ed764bfc209c599a4a647ee1b9e3dd1

Request headers

Referer: https://paint.toys/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
x-api-key: 79db72eb0b5c7255afa54a253df24fb4a5ac916bf40b51c730df8850aa5665ca

Response headers

x-amz-apigw-id: K8l3ME-ZPHcEvkg=
x-amzn-trace-id: Root=1-682e8360-02ef8680645a539a5e0548b1
access-control-allow-methods: *
x-amzn-requestid: a9668404-b94a-4958-af77-ac9ab627d433
access-control-allow-origin: *
content-length: 146
date: Thu, 22 May 2025 01:52:32 GMT
content-type: application/json

OPTIONS
H2 204 putRecords
prod.tahoe-analytics.publishers.advertising.a2z.com/logevent/ Frame 0
0 724ms
239ms Preflight 52.41.64.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://prod.tahoe-analytics.publishers.advertising.a2z.com/logevent/putRecords?encoded=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.41.64.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-41-64-239.us-west-2.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-api-key
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: *
date: Thu, 22 May 2025 01:52:32 GMT
x-amz-apigw-id: K8l3JGhFPHcEoNA=
x-amzn-requestid: 09a67666-b5bf-4899-966f-b5d23831a536

GET
H3 200 ads203. Show response
fundingchoicesmessages.google.com/f/AGSKWxVnbBuhk6YhHtE4JieZKXW_C9O0VhB5_hXQeSaExw9TaXEfSsHfn6LjlidwvTfunq2RfFF1_UEuLYmvI81XvSJCGMagZ0CwNEvGB32uzIa4B9-6IuJibdQpWpxEu-t469ieXFkuYh1-0xOtHW3JGJrFWPH-n... 54 B
109 B 419ms
418ms Script
application/javascript 172.217.173.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVnbBuhk6YhHtE4JieZKXW_C9O0VhB5_hXQeSaExw9TaXEfSsHfn6LjlidwvTfunq2RfFF1_UEuLYmvI81XvSJCGMagZ0CwNEvGB32uzIa4B9-6IuJibdQpWpxEu-t469ieXFkuYh1-0xOtHW3JGJrFWPH-n7LMOZ8KCFxObfdLjSNWWfmPwmnfhjBw/_/spotx_adapter./site_under._ads/js//generate_ads./ads203.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwRjfQquch2XBOAKw7IoCcozaVYqQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.173.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bog02s13-in-f14.1e100.net

Software

ESF /

Resource Hash

c36d7695c7223611e12e5de52041f2ec2ada62dad1e140c64b24e82a16dd8119

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PmuwWDwz9wo5mowg-Z3SNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:32 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw05BiaL15jnUqEButPc_qBMSGCpdYHYH4_rpLrM-B-EP9ZdYfQFwkcYW1CYg_Vd1gFaq-wZrEfpO1CIhDHW-yxoJw2k3WVCDetfEW6yEgbtK-zdoFxGZ-t1ntgFiIh-NB266DbAIfbuzYzKykkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAAGPlDlg"
content-security-policy: script-src 'report-sample' 'nonce-PmuwWDwz9wo5mowg-Z3SNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 40 KB
15 KB 958ms
328ms Script
text/javascript 142.250.218.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_GB.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwRjfQquch2XBOAKw7IoCcozaVYqQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.218.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

rio06s13-in-f2.1e100.net

Software

cafe /

Resource Hash

055545ec4c1e204e191b7ff91e6195763af05a8b11862536770b1973c7e872b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5823782017674029676
age: 2863
x-content-type-options: nosniff
expires: Thu, 22 May 2025 02:04:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 01:04:50 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 15063
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUlzAgOqOMUxh5tBY4OhAftn-57a1I7ZzJv_3pG0Lv6Lfz-o0NsL4_9KnsXDzsgqorJKq5mzF93-xpCMKGP-7uVU7mxMGOJuQOBlIK00o3TrFdFUH6zMYwP_IkjCKQC5NGitmmvIg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 781ms
398ms XHR
text/html 172.217.173.206
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUlzAgOqOMUxh5tBY4OhAftn-57a1I7ZzJv_3pG0Lv6Lfz-o0NsL4_9KnsXDzsgqorJKq5mzF93-xpCMKGP-7uVU7mxMGOJuQOBlIK00o3TrFdFUH6zMYwP_IkjCKQC5NGitmmvIg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.173.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bog02s13-in-f14.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0h6ez8WmzXkbFOwoCf1Ubg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 01:52:32 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw15Bi-FB_mfUHEJv53Wa1A2IhHo4HbbsOsgl8mP2rm0nJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRqYGhnoGZjGFxgAAKhEJ6o"
content-security-policy: script-src 'report-sample' 'nonce-0h6ez8WmzXkbFOwoCf1Ubg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 4E24 4 KB
4 KB 926ms
308ms Document
text/html 137.184.70.213
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.70.213 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: ce5e64339fa2cb0192827f8c225c3b8e1d04e53c870a238588f5459f4f964c56

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4089
content-type: text/html
date: Thu, 22 May 2025 01:52:32 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 240ms
238ms XHR
application/octet-stream 35.162.56.239
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.162.56.239 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-162-56-239.us-west-2.compute.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 01:52:32 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 1 KB
2 KB 99ms
98ms Script
application/javascript 13.237.11.119
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=1&pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_321f853c-287c-46b6-953e-49f689282343_1747878746822
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.237.11.119 Sydney, Australia, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-237-11-119.ap-southeast-2.compute.amazonaws.com
Software: /
Resource Hash: bb535d69b724c58a18b88b702ed5df2af6b1a89f5a67d189ea2584d6e8251221

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1237
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 01:52:32 GMT
Content-Type: application/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 75F8 1002 B
1 KB 96ms
95ms Script
text/html 67.199.150.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=16490806&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.81 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: c69fdab9055c6c417d46381547667d76043eb64d66b645aee098d429b45dc918

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1002
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 01:52:32 GMT
content-type: text/html; charset=UTF-8

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 3384
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5032325447999996024&gdpr=0&gdpr_consent=

42 B
297 B

95ms
95ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5032325447999996024&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 01:52:31 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 441d6b28-ac95-4ecd-a962-d8da6ced4ca3
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 01:52:32 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=5032325447999996024&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 103.108.231.107; 103.108.231.107; 1048.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2

200

sync Show response
odr.mookie1.com/t/v2/ Frame D7BC
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=4856bb54-744d-4456-ab03-cb5400f9496c&gdpr=0&gdpr_consent=&gdp...
https://x.bidswitch.net/sync?ssp=ucfunnel&user_id=a4659670-a243-303f-997b-77365b5abe42&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=4856bb54-744d-4456-ab03-cb5400f9496c&ssp=ucfunnel&gdpr=0&gdpr_consent=

42 B
204 B

409ms
224ms

Document
image/gif

34.111.79.67
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=4856bb54-744d-4456-ab03-cb5400f9496c&ssp=ucfunnel&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.79.67 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 67.79.111.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
content-type: image/gif
date: Thu, 22 May 2025 01:52:34 GMT
etag: "6530c7b4-2a"
last-modified: Thu, 19 Oct 2023 06:07:48 GMT
server: nginx
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 22 May 2025 01:52:33 GMT
location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=4856bb54-744d-4456-ab03-cb5400f9496c&ssp=ucfunnel&gdpr=0&gdpr_consent=
via: 1.1 google

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0A22
Redirect Chain

https://cm.ambientdsp.com/cm/send?vc=pmj&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=197ej7k5l5ek

1 B
168 B

96ms
95ms

Document
text/html

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=197ej7k5l5ek
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 01:52:31 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-encoding: utf-8
cache-control: no-store
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQ0OSZ0bD00MzIwMA==&piggybackCookie=197ej7k5l5ek
lws: 127.0.0.1
strict-transport-security: max-age=31536000; includeSubDomains
time-ms: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CF9F
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&g...

42 B
350 B

97ms
96ms

Document
image/gif

207.65.33.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.33.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 01:52:31 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT Thu, 22 May 2025 01:52:32 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=-HhHCsxW6dfR8TTSnxe0GANFPcsEZIayr6-cIKIIWfI&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame A6E2
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=6_40-uX1M_nw8WSo7_crpur3Na7w8TOmvPNbrHSX

42 B
338 B

95ms
95ms

Document
image/gif

67.199.150.86
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=6_40-uX1M_nw8WSo7_crpur3Na7w8TOmvPNbrHSX
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 67.199.150.86 Singapore, Singapore, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 01:52:32 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Thu, 22 May 2025 01:52:32 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=6_40-uX1M_nw8WSo7_crpur3Na7w8TOmvPNbrHSX
strict-transport-security: max-age=86400

GET
H/1.1 200
OK ecm3 Show response
s.amazon-adsystem.com/ Frame 46A5 43 B
479 B 310ms
309ms Document
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=379DA860-367D-482E-BB52-F3FEE924EE87

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3D

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS