paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 13894
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 05:15:50 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JVV6PM0XVDBF4NB34MY9ZB66

Redirect headers

accept-ranges: bytes
age: 12662
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 05:15:50 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JVV6PKYCMMBXKH3T9B6JNGAS

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 422ms
226ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d08ff5524fda53a59b6babe2249e4e93c3b6b3c8de0ca8ace5cb76f1488a8c78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 9439d6885a6478e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 157ms
156ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 20345
accept-ranges: bytes
content-length: 1406
x-nf-request-id: 01JVV6PM3WXJ1M7AZR82JQ15EV
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 79ms
78ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 14641
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JVV6PM3W3ZKEQ7FSC27KR3V0
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 81ms
81ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 4134
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JVV6PM3WEFBA047R08KWBRD0
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 82ms
81ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 20345
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JVV6PM3W0YD2WZ5CYC5TFP3H
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 79ms
79ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 20345
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JVV6PM8TTWCWZ6MS2VK3F20W
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 82ms
78ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 20345
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JVV6PM8YEGCNK6H6PDGFCB1Y
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 05:15:50 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 125ms
90ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5490077d58f4478ec71ed2231c72bcf8587be8f3644573ecca28d9a30d5c8e59

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9439d6885a6678e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 370 KB
125 KB 458ms
173ms Script
application/javascript 2607:f8b0:4006:808::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e5abc4dd278197a5781ee41303fc145e06c5c7d13999dd554ebccbde9b583d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 05:15:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:50 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 127359
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 j406wv9b45h_3.v2.js Show response
faucetfoot.com/assets/js/ 68 KB
25 KB 276ms
104ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

2459daf4a3941865c4dfc8440e3844797639afb1826b7afb4b5c862e78258eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-spot-jb3g.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 457ms
170ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

713420a474962d2d21028cfd1cd588021a1e76a3a0babc50922b7f5e2f8e56b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 533 / 20230 / 31092563 / config-hash: 2851738409813473497
x-content-type-options: nosniff
expires: Thu, 22 May 2025 05:15:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 05:15:51 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34293
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 94ms
94ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 5448
cf-ray: 9439d689dbfb78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 411 B
365 B 87ms
87ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cefb14adf44d7be710ac086bd9956380a96dc8220bcca80af1144e3c5312877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"d8cc960b7ac2417b4c245b40d1501e32"
age: 6543
cf-ray: 9439d689dbfd78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
415 B 178ms
90ms Script
application/javascript 104.18.24.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c48dd959b0d47ff89ea3a1daca0f0d3846849b3dd80fbb2a4feaad51a5f41a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 9439d68a6faac798-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 22 May 2025 05:15:50 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.688a9519bf222c577628.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 335ms
335ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adb9d1101e62377f34b6db7996ffc4eb80f8968ae7063b988ba2d85ee2ec2a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2014aef5a932767aee99c8c09ee9aea2"
age: 6549
cf-ray: 9439d68a6c8a78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.de88eb0a31bf4b182063.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 519 KB
157 KB 336ms
335ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6395a8c7b596927e52b00afe7511a91cf9043ae95d61763316ab139974b1bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"81a507d88d3b44587deef78119119de8"
age: 6549
cf-ray: 9439d68a6c8c78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:50 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 138ms
137ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 38674
x-content-type-options: nosniff
expires: Thu, 21 May 2026 18:31:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 21 May 2025 18:31:17 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 559 B
468 B 89ms
88ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 6541
cf-ray: 9439d68f491b78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:51 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 1E23 503 B
427 B 611ms
384ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 6549
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9439d690bdc12f63-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 05:15:51 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame BADD 503 B
0 604ms
604ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 6549
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9439d690bdc12f63-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 05:15:51 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/1/desktop/Chrome/ 584 B
920 B 988ms
139ms XHR
application/json 2600:9000:24f1:1c00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/1/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:1c00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: d486c30f6478ebc20b7ff05dc35fc08c4ff8139916989f63f1a9c59bb5110e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 924
via: 1.1 1631ac35bac9cbaaa7c65e1bf3666d7a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: 00rEMtxRHukgHCaKx0Cwsz4VFVVA1WP-9mBml2CN1ms4_843jCdvGw==
date: Thu, 22 May 2025 05:00:28 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 238ms
80ms Script
application/javascript 2606:4700:10::6816:4bd8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bd8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e28a9ac4afbb61e4bb6cc21c8f5772bcffc6e87cbf7f3af3522be2dd76b3010d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "a7eb27bf47173c9b4e82d2dcc163412f"
via: 1.1 google
cf-ray: 9439d690786923b2-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39584
date: Thu, 22 May 2025 05:15:51 GMT
content-type: application/javascript
last-modified: Thu, 22 May 2025 04:52:05 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 83ms
83ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 6542
cf-ray: 9439d68f794578e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:51 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 1318ms
155ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 1466
via: 1.1 0dc81f450c72d91e34b5a0b41d441f28.cloudfront.net (CloudFront), 1.1 f359087e1d20f17f76b31eb5ffbbd450.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 96SMbdN3frD_NBWFS05GrqaOfFtptkamkLCOzhomoGzhDl_mXrisnQ==
date: Thu, 22 May 2025 04:51:27 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P2, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
589 B 689ms
227ms Image
image/gif 2606:50c0:8003::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: b4eebcb64f789ecfc52ddd4b9b7363b2c3009961
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 9505:14FA39:997900:B00289:681072E4
expires: Thu, 22 May 2025 05:20:52 GMT
x-cache: HIT
date: Thu, 22 May 2025 05:15:52 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350021-TOJ
x-cache-hits: 2
source-age: 80
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1747890952.135853,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
111 KB 171ms
171ms Script
application/javascript 2607:f8b0:4006:808::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55k1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

52601a7d4bbcd9a06d6f9ee187416ed60bd8d522c5e8ef75caa8a42ac812f259

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 05:15:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:51 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 113347
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 445ms
160ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55k1v9101576445za200&_p=1747890950232&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=61799409.1747890952&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747890951&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2116
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:51 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 562ms
267ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 442ms
131ms Image
image/gif 2600:9000:247b:600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=7396850_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 6776
x-cache: Hit from cloudfront
x-amz-cf-id: KfsXuug0jE6P4XHoEFTLtZxpc8OaXR6cT_mmU-upHH-M8U-XcC7PPw==
date: Thu, 22 May 2025 03:22:57 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 38385695b10551583d750b943a475982.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 461ms
148ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 38146
via: 1.1 eabcac050cde7358c94fc7ecf124ea4a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: UMQG-yR5CG5UqTIkfhijGsjjsnDF4tnd7n05OMiwkD-_x-PIXCND2Q==
date: Wed, 21 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505200101/ 63 KB
23 KB 163ms
161ms Other
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505200101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

71599f3f2650b062aed2f01f9974f503eda91c1ed89486be19839813dc0578a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 1077713666436866443
age: 51272
x-content-type-options: nosniff
expires: Wed, 28 May 2025 15:01:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 21 May 2025 15:01:19 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23467
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505200101"

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 269ms
119ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 240ms
86ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8194
x-goog-stored-content-encoding: identity
expires: Fri, 23 May 2025 05:15:52 GMT
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 05:15:52 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9439d693ab0ef7bf-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 292ms
135ms Image
image/x-icon 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 38795
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 22 May 2025 18:29:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 18:29:17 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
567 B 238ms
86ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.9300766523095272
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 8194
x-goog-stored-content-encoding: identity
expires: Fri, 23 May 2025 05:15:52 GMT
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 05:15:52 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9439d693ab0af7bf-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 200 ab93v0d2abbu0f7xc3 Show response
faucetfoot.com/0/h1vuruh/ 295 B
319 B 188ms
108ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/0/h1vuruh/ab93v0d2abbu0f7xc3

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

1cf35e0640e9c49c031fd5559f3b1a885d7874b2fc586b35d426b382770607ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-test-jqg4.gce-us-west1, 1.1 google
expires: Thu, 22 May 2025 05:15:51 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 1E23 17 KB
7 KB 84ms
83ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6549
cf-ray: 9439d69328cd2f63-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame BADD 17 KB
0 79ms
79ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 6549
cf-ray: 9439d69328cd2f63-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 200 KB
65 KB 476ms
175ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0829a39445b0014c05cdf430af57e1b4a646c1a6461ba644234f12233a2a5194

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n4iDFd9UojhTS7cS0dGKJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIh6Pj2a6DbAILXjUcZVLSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTA1MtAzMIgvMAAACQ5DPg"
content-security-policy: script-src 'report-sample' 'nonce-n4iDFd9UojhTS7cS0dGKJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 149ms
148ms Fetch
text/plain 2607:f8b0:4006:809::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55k1v9102396898za200zb9101576445&_p=1747890950232&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~102938614~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&ptag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=61799409.1747890952&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747890952&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1747890950232&tfd=2871
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55k1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:809::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 272ms
116ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json
vary: Origin

GET 39aceb57-3ae8-4771-ba02-278156f6a7a6
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 389ms
129ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 05:15:51 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 222889
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 136ms
133ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 174ms
85ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 3477
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 22 May 2025 04:17:55 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 9439d695ae3ccb91-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
1 KB 89ms
88ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 6547
cf-ray: 9439d6951e8d78e5-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:27 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 413ms
131ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 3b587f1eeb8559e6eb8d75f0770409ee4bfdf3ac69501f420912ed4c51a4ee8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 459ms
172ms Script
text/javascript 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2408f96d0ae09f62f95d73bcc6f521f5e7cd2b62f46a57ae450a36a386632fae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4408055776961230618
x-content-type-options: nosniff
expires: Thu, 22 May 2025 05:15:52 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145165
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 685ms
222ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-100-29-97-158.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
773 B 440ms
159ms Fetch
application/json 34.239.219.126
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.219.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-219-126.compute-1.amazonaws.com
Software: /
Resource Hash: 9536ea4310a4fa40f0351ea73fded1e241e44510b02afd6c3d8b85a91ee16f92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 431ms
135ms Fetch
application/javascript 52.207.110.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.110.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-110-172.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 26ce6d8c39dd6b1040b6d9fe33f1878bd8d912e45ea1fef3bef83ed29cf08347

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 250ms
96ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: bdc46e84d328a5c5ed72f2638e2ede88cc2208b62d2c3e71c97701de9495d509

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 178 B
589 B 414ms
138ms Fetch
text/plain 100.29.97.158
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.29.97.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

2847c1371775cf6bec6bdea20ecb7de2553386964227657e9ab445dbd0ea284a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 77af2e47e400a905
request-time: 5
access-control-allow-credentials: true
expires: Fri, 23 May 2025 05:15:52 GMT
access-control-allow-origin: https://paint.toys
content-length: 178
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=wKQDLXxLYW4wUEc2UTRpakpweFo2U3pGWTFWRXJnU201TkZqRkhuV2FkSy8rVTh6NnZCSzNuM2hpTzRRMEFPWGRSK0JTTzYyZXBtUEM3Qk40bGJaTi9zUWFUNmE4azc3ZHFZNjBGNTlLMFVlREZvKzY3ZERFaVAwMitIRm...

362 B
931 B

380ms
126ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=wKQDLXxLYW4wUEc2UTRpakpweFo2U3pGWTFWRXJnU201TkZqRkhuV2FkSy8rVTh6NnZCSzNuM2hpTzRRMEFPWGRSK0JTTzYyZXBtUEM3Qk40bGJaTi9zUWFUNmE4azc3ZHFZNjBGNTlLMFVlREZvKzY3ZERFaVAwMitIRmxVa1lCZWI1ODZ2c2wzS0tsSDlsUldKdngzT1k4bjhYdXpPODN4azNmdCtqcHRCcmduZ2VHQmJ0b1V3M0lQbjMyOGFpbWM5VitSQzArS0FlUHRIbk5tRkJrUFVtMEd3bE1FTDIxcnBrdnpESXNPTE9oNlUveDl0ejNqNUFXbWpGbUFKZW9PQWUzfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0fb1e38133c0e80a8a8d5a41052a01faa9922c72356903ec954e6bc595fc9f9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 509648
expires: 0
access-control-allow-origin: null
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=wKQDLXxLYW4wUEc2UTRpakpweFo2U3pGWTFWRXJnU201TkZqRkhuV2FkSy8rVTh6NnZCSzNuM2hpTzRRMEFPWGRSK0JTTzYyZXBtUEM3Qk40bGJaTi9zUWFUNmE4azc3ZHFZNjBGNTlLMFVlREZvKzY3ZERFaVAwMitIRmxVa1lCZWI1ODZ2c2wzS0tsSDlsUldKdngzT1k4bjhYdXpPODN4azNmdCtqcHRCcmduZ2VHQmJ0b1V3M0lQbjMyOGFpbWM5VitSQzArS0FlUHRIbk5tRkJrUFVtMEd3bE1FTDIxcnBrdnpESXNPTE9oNlUveDl0ejNqNUFXbWpGbUFKZW9PQWUzfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 289976
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 05:15:52 GMT
server: Kestrel

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 267ms
258ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H2 204 pv
api.btloader.com/ 0
0 225ms
116ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=9y1IbTk88m-xjCYjUNp-96f66b5786&sid=ZAicP5y3Z-eK4va5xloK-96f66b5786&cv=2.1.101-2-g7338edb&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:52 GMT
vary: Origin

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_0522a6d0-b439-40da-b9c1-2921588aac0d_1747890952413
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMDUyMmE2ZDAtYjQzOS00MGRhLWI5YzEtMjkyMTU4OGFhYzBkXzE3NDc4OTA5NTI0MTMQABoNCIjmusEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=6be398eb28c4e992164cd3ffd0d9bb0ba9997b24091b497cbb2886a353e40557791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=6be398eb28c4e992164cd3ffd0d9bb0ba9997b24091b497cbb2886a353e40557791426b5417dce21&rand=05987433
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=6be398eb28c4e992164cd3ffd0d9bb0ba9997b24091b497cbb2886a353e40557791426b5417dce21&rand=05987433&expected_cookie=71a68f68-b3c5-4913-a5bc-d67626c9af20

0
144 B

164ms
163ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=6be398eb28c4e992164cd3ffd0d9bb0ba9997b24091b497cbb2886a353e40557791426b5417dce21&rand=05987433&expected_cookie=71a68f68-b3c5-4913-a5bc-d67626c9af20
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 5F14BB129BCE4AD78A5CB2B717FDBAD8 Ref B: LAX311000108045 Ref C: 2025-05-22T05:15:53Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1spNm5A4fGWMq/jvExA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 22 May 2025 05:15:53 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=6be398eb28c4e992164cd3ffd0d9bb0ba9997b24091b497cbb2886a353e40557791426b5417dce21&rand=05987433&expected_cookie=71a68f68-b3c5-4913-a5bc-d67626c9af20
x-msedge-ref: Ref A: 407A2BE175F64B4F97878B6E2282E05B Ref B: LAX311000108045 Ref C: 2025-05-22T05:15:53Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1spNkFRydboa5O8WrUg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 22 May 2025 05:15:53 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_0522a6d0-b439-40da-b9c1-2921588aac0d_1747890952413
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_0522a6d0-b439-40da-b9c1-2921588aac0d_1747890952413

1 KB
2 KB

133ms
133ms

Script
application/javascript

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_0522a6d0-b439-40da-b9c1-2921588aac0d_1747890952413
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: 6c1b67bb3747b6319ae02da6e0a3e88c908413fbb640301c6fda2910d37db04c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:53 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_0522a6d0-b439-40da-b9c1-2921588aac0d_1747890952413
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:53 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
446 B 422ms
146ms XHR
application/json 34.206.215.155
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.206.215.155 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-206-215-155.compute-1.amazonaws.com
Software: /
Resource Hash: 8a3b0998bd9a9e9adb035fcc20719bd169da546bc518be3a68048b1dcf1ec782

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 22 May 2025 05:15:52 GMT
content-type: application/json;charset=utf-8

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 136ms
132ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 132ms
130ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1747890952990&did=did-0046&se=e30&duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.dir...
https://rp4.liadm.com/j?dtstmp=1747890952990&did=did-0046&se=e30&duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.di...

13 B
370 B

425ms
132ms

Fetch
application/json

3.224.197.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1747890952990&did=did-0046&se=e30&duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.224.197.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-197-84.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 1b3a7155-f558-4dc6-934d-077e25b897f1
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1747890952990&did=did-0046&se=e30&duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo0
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 05:15:53 GMT

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 413ms
133ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 22 May 2025 05:15:53 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 413ms
130ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 AGSKWxWiF9lmsHaaghtC59irE9L2wCkfJBfX1SGmu-kr5-ObNGqf8ffTyO_mZrjsT4LUA165a_4RDLzOwR2V_90cS_frlPcKWWCsNeoYwXtiR6jcaAMHexsJXDoO7D-82UZ8PSjZho-GVg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 168ms
167ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWiF9lmsHaaghtC59irE9L2wCkfJBfX1SGmu-kr5-ObNGqf8ffTyO_mZrjsT4LUA165a_4RDLzOwR2V_90cS_frlPcKWWCsNeoYwXtiR6jcaAMHexsJXDoO7D-82UZ8PSjZho-GVg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODkwOTUzLDU2MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsIm9hSzdhRm9fZi1VIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInNkZ3dzcS5kaXJ0Y2hpY3Z0LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9ef7a701d0d70de979eb53d91ae15c8696d65b8c10c2e8c86d7fd9ef3b59607a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KX_DHQGL_Ulv-uSU_Pc10g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmII1JBiOHHrNtMFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIP1XdYBWpvsGaxH6TtQSIQx1vssaCcNpN1lQgXrPxFutWIG7Svs3aBcRmfrdZ7YBYiJuj89mug2wCB87O9VDSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTA1MtAzMIgvMAAACy9H3A"
content-security-policy: script-src 'report-sample' 'nonce-KX_DHQGL_Ulv-uSU_Pc10g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 64D2 102 KB
28 KB 404ms
134ms Document
text/html 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1029
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 04:58:44 GMT
expires: Thu, 22 May 2025 05:48:44 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 467ms
144ms Script
application/javascript 2600:9000:24f1:800:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:800:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 2301
x-cache: Hit from cloudfront
x-amz-cf-id: eAWjWw1_AFiJUfM8UjLqz7vbS40ZirYNYVIVQ3zkHD8tXyIkqMcopw==
date: Thu, 22 May 2025 04:37:33 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 41c6f8f93eca2f7c81a04a82e2d6ae92.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 216ms
69ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 599227
x-goog-stored-content-encoding: gzip
expires: Fri, 15 May 2026 06:48:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 15 May 2025 06:48:46 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwqQ3cK0YoGx_uXG6j0gqdsrI5WggkF9xKRcPR_W71-VCnQr_EiOeK00Gm3-5ipV1sdNUfSKanI
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 391ms
239ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 22 May 2025 05:15:53 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 84362254f0139c94b8881ef728b91fe8

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 245ms
89ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 232408
cf-ray: 9439d699d9e0d88e-LAX
expires: Sun, 25 May 2025 05:15:53 GMT
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 524ms
255ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 23 May 2025 05:15:53 GMT
access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 397ms
134ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 43437
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: WEIpfVhzawo9cdsmRhODlenQqk_FYSDVPYCsZ6LFGU2b7_8aXE04Yg==
date: Wed, 21 May 2025 17:11:57 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 6741f9acf28bc52b25f06e9986a71e26.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
828 B 424ms
132ms Script
application/javascript 108.138.106.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-59.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 2910
via: 1.1 eb4c39562c3ea08ed99a3ec30c18db3c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: im5P2fsVF9WYnMgsiPMBQOS5OcV04-0wWKJWo7p1GqyWc921r3dcLQ==
date: Thu, 22 May 2025 04:27:23 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 134ms
134ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 18933
access-control-allow-credentials: true
via: 1.1 f359087e1d20f17f76b31eb5ffbbd450.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: o3yd6HmtZ1lA9k3xvNuaJQd_IlcG5N52ISVDNn8tKG3Kaa6k6jO_MQ==
date: Thu, 22 May 2025 00:00:20 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
373 B 678ms
346ms Fetch
application/json 18.173.140.220
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&pid=d1odCxYlHe4nY&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=5cfe6e9d-35bc-4324-82a7-995d64dec163&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D&vm=%7B%22vendors%22%3A%7B%22liveintent%22%3A%7B%22data%22%3A%7B%22default%22%3A%7B%22user%22%3A%7B%22ext%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22liveintent.com%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2215-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D%22%2C%22atype%22%3A3%7D%5D%7D%2C%7B%22source%22%3A%22bidswitch.net%22%2C%22uids%22%3A%5B%7B%22id%22%3A%22f726dd3f-acd0-4ebb-a862-e242e14043d8%22%2C%22atype%22%3A3%2C%22ext%22%3A%7B%22provider%22%3A%22liveintent.com%22%7D%7D%5D%7D%5D%7D%7D%7D%7D%7D%7D%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.140.220 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-140-220.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 15b20cdc545f9b56059a7fe493f5451a.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: 8kdu3U2tu9U2P0zg120qJ7V6HAs6YQk8kn5tdp88H0WnSjZrvoci1w==
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK52-P2
server: Server

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 136ms
132ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 AGSKWxUpTHLh9IZ02dQMm4cCM2JlP7sTZLc37zdDBCLFa_kSpTMYiihm2LIAW042AACFJ5wA3cjZYMkuP4IEWugqeIy6kYYyb7xabzBudtdnwBN6kwP-s6WjbezVcxMN5O7vvV_5ifO3nw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 168ms
167ms Script
application/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUpTHLh9IZ02dQMm4cCM2JlP7sTZLc37zdDBCLFa_kSpTMYiihm2LIAW042AACFJ5wA3cjZYMkuP4IEWugqeIy6kYYyb7xabzBudtdnwBN6kwP-s6WjbezVcxMN5O7vvV_5ifO3nw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODkwOTUzLDI0NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwib2FLN2FGb19mLVUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwic2Rnd3NxLmRpcnRjaGljdnQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7787bb7f9b9775805b72e725013bf4233948c137a9d46ea2262e2142f468105

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Ep2GKBr9TOt3ZqfbCBK1-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtHikmLw1ZBiWMy_i6n15jnW6UBstPY8qwsQGypcYnUG4vvrLrE-B-IP9ZdZfwBxkcQV1hYg_lR1g1Wk-gZrEvtN1hIgDnW8yRoLwmk3WVOBeM3GW6xbgbhJ-zZrFxCb-d1mtQNiIR6Ozme7DrIJvHg2YxGjkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkamBqZGBnoFBfIEBAADSRNQ"
content-security-policy: script-src 'report-sample' 'nonce-Ep2GKBr9TOt3ZqfbCBK1-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 688ms
224ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

815c6e7ae2d7690a4a286267010e7f5f9db08c536967b5954a84f16fede27b09

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 1F65 1 KB
2 KB 225ms
69ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 835
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:01:58 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwqETBFErECvWiZDZGGZ3i0xsXh_7lCDOZr5KyyrS7p3kuTmdMAYOvsxkQ4U1VmSfW5n

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame B995 2 KB
1 KB 485ms
133ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=53611
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 22 May 2025 05:15:53 GMT
expires: Thu, 22 May 2025 20:09:24 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 268ms
166ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6abd11315359ca175c8a158b48b2db1a8c89c954d302fc0e4f4a8e33709161d5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747890953&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Z8PcNWwzgHMisj2N%2B6e1vEEpDiOFM4tj%2B4eWy0p9DKY%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747890953&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Z8PcNWwzgHMisj2N%2B6e1vEEpDiOFM4tj%2B4eWy0p9DKY%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9439d69aef900908-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 58 KB
36 KB 1819ms
1717ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfe0de0966f9809bb94c41e248a87463876e0d2e80cd6474b41699902aed5257

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747890953&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Z8PcNWwzgHMisj2N%2B6e1vEEpDiOFM4tj%2B4eWy0p9DKY%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 05:15:55 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747890953&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Z8PcNWwzgHMisj2N%2B6e1vEEpDiOFM4tj%2B4eWy0p9DKY%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9439d69aef8e0908-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
609 B 466ms
302ms Fetch
application/json 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d82b46653e783a3efbb35d3b87094c409d721b01209402564b81e1acba313214

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9439d69b5f0d08d3-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 474ms
127ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=77116200284&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:53 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 604ms
253ms Fetch
application/json 3.208.175.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-175-5.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 481ms
137ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 565 B
736 B 676ms
333ms Fetch
application/json 3.239.124.147
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.124.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a086759ce25201c7d3b408c53d53e5848fc368e37e83f3eeb13bf0668d5d6d30

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 380
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 612 B
715 B 640ms
297ms Fetch
application/json 3.239.124.147
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.124.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

264d1c2ba1b855163c333d39f86340f964ea3deb0c2759c9f5edf0423e7bea5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 359
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 600ms
258ms Fetch 3.239.124.147
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.124.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 601ms
258ms Fetch 3.239.124.147
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.239.124.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 38 B
668 B 250ms
95ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cde619db37742fa5fd1367ba21f5591b27177c7520ecaec7d7a9e614423c634

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljUWZ3fR9N3Trp8Wk07rSxwgj5Pa5ON0BJ%2FZxegLAIJhUZ7Q1uT4pI5BvXI1MlxQNe0860lRECePoIsMjjH9lh1WuZXBioqbfEEyeSIpiP4nThwN%2B%2BPsqDDwcFK%2BHXIlzCKtvLoQ"}],"group":"cf-nel","max_age":604800}
cf-ray: 9439d69b6c967d80-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 38
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 690 B
1 KB 569ms
235ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=aa923f62-bb4e-446d-bd26-8d7e7b92b9dc&l_pb_bid_id=934d0bac212e0b98&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=a34a7b1e-a42d-4ecf-b194-124e7f767c00&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.8873314591177385
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 44cdba8cfd94aeef63a5cd1a43877f0c9f4e7df76a251577ac8a506a33bc598b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 522 B
1 KB 554ms
220ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=aa923f62-bb4e-446d-bd26-8d7e7b92b9dc&l_pb_bid_id=944aae06a3b75a8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=007e928c-5338-4331-923f-2abc73f0b7af&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.9466167483907544
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: bca185a8536fb3c3694e34403f24565fa4b5863d9524787056fbdb6b9884a7d6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 522
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 528 B
888 B 569ms
236ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=aa923f62-bb4e-446d-bd26-8d7e7b92b9dc&l_pb_bid_id=95d6f951a2b9f1c&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=0c4ac8a8-252c-44ae-8342-f2fe6469c62d&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.4946394487595176
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: f601d74a48aec07fd8cc33996538c20bcdd00ddad357201b67a3d73993d8b9ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 528
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 528 B
887 B 693ms
361ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e%5E1%5E%5E%5E%5E%5E&eid_neustar.biz=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs%5E1%5E%5E%5E%5E%5E&eid_liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D%5E3%5E%5E%5E%5E%5E&eid_bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8%5E3%5E%5E%5E%5E%5E&eid_linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=aa923f62-bb4e-446d-bd26-8d7e7b92b9dc&l_pb_bid_id=963f1621468270b&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=1ad8cc24-08c3-4c38-b145-8ed7b6c36479&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.2893091174294583
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 23bde6d0522ec53b512f33736b2c1ec0b6960eab360b8b91a49baf43d9edddd5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 528
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
626 B 477ms
141ms Fetch
application/json 3.168.102.47
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-47.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 4de4f48ee76fc825c6f5a665999c98c2d1d277205b00d224a707ed6486a7ff0b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 4d9a3325cf123acd8863ea1677b5760e.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: 2fE1CVWjOjm5lwDCj_uyaFR57bh0XVgTDbKfaMIJkzBgp6lBuY9Pqw==
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 250ms
100ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 6bb553d42ae3a1ebe613e4823ad2bec0a3c3c6579ccdd9fd3442c5b373d2b319

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.246
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/plain
vary: Origin

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
581 B 596ms
269ms Fetch
application/json 68.67.160.184
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.184 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: eda76c99-e519-4142-bc3b-513f3c29fd0a
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:53 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 339ms
97ms Fetch
application/json 52.35.249.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747890953334&to=600&aun=pw-160x600_atf&pubcid=37ff7810-8b25-4f71-88f5-2ed15f88c14e&fabrickId=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33acrossId=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&lipb=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=a34a7b1e-a42d-4ecf-b194-124e7f767c00&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6605&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.249.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-249-35.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 342ms
100ms Fetch
application/json 52.35.249.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747890953335&to=600&aun=pw-160x600_btf&pubcid=37ff7810-8b25-4f71-88f5-2ed15f88c14e&fabrickId=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33acrossId=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&lipb=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=007e928c-5338-4331-923f-2abc73f0b7af&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6605&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.249.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-249-35.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 341ms
100ms Fetch
application/json 52.35.249.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747890953335&to=600&aun=leaderboard_atf&pubcid=37ff7810-8b25-4f71-88f5-2ed15f88c14e&fabrickId=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33acrossId=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&lipb=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=0c4ac8a8-252c-44ae-8342-f2fe6469c62d&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6605&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.249.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-249-35.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 339ms
99ms Fetch
application/json 52.35.249.35
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747890953335&to=600&aun=leaderboard_btf&pubcid=37ff7810-8b25-4f71-88f5-2ed15f88c14e&fabrickId=E1%3A4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33acrossId=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT%2FTohmq772JA4z969BI%2Fr2DRE7qmgMneu7nJsdAL7%2BccdEkJIyGx0gjff0bA9p2s7kDtw2%2BrdOqpowFRvTUrxVy5m%2B8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL%2BnCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT%2BtEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP%2BvE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03%2FK9GuEVMVhZtoS25Lw9%2BZ64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K%2BBZxBx1I1Q%2BVlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa%2Fj7kohjw%2BsE6Qg7OlUoI%2BbxTMpiqibzYJRvlOhJo%2BytlcfMgNaOSkUo8AR%2FDLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk%2BE%2Bo7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G%2BsS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3%2F9k99U0b3ZYxhsE8K%2FQsXK97XFAve%2BsbkETpofjBpVP%2BNR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r%2BqDbh7tmiLZkfxqR%2BI3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv%2FsPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM%2Fy845k6m6%2BYwnRYjc7QwoL%2B6xV%2BlC6gkvySik8edswoHMeaCSyv2H%2Bce8Sb1l32tDnP6P%2FvnBQZ%2FMLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT%2BKCKlTI0EmO1yaV2OypvNFnwubr%2FXvk%2BdG8mXOfxvSrkmCs3yFCyX%2F4ubWqjGP6xWdDGN%2FdXTA%2BMiVFNqhvJ9hfKY%2BS3Sb%2BIDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h%2BKrYnejwyPir9wHzmRjjh3n%2BTPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11%2FE5YsF3%2Fey8%2FDw30zdw7bdCk7IekCJKhkYLXh7GTy%2BmrjNS%2BixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS%2FNBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&lipb=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22%2FAi%2FJUw%3D%3D&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=1ad8cc24-08c3-4c38-b145-8ed7b6c36479&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6605&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.249.35 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-249-35.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 776ms
417ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:54 GMT
server: nginx

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 40 KB
15 KB 623ms
304ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

8be75f91182f49586052db74cff625687e778985320a56f1dcd160e79b2425e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1515ms
1170ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 05:15:54 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1521ms
1176ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 05:15:54 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 696ms
351ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 05:15:53 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 2023ms
1679ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 05:15:55 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 465ms
132ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 05:15:53 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 220210
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 473ms
133ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 22 May 2025 05:30:53 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 22 May 2025 05:15:53 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 157ms
154ms Script
text/javascript 108.138.128.46
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-46.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 38147
via: 1.1 eabcac050cde7358c94fc7ecf124ea4a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: nZj2KbH8WgCotMBcGLXY2qgR1IZ7ZjXx7oJqwFLemhgTaGIpXALlvA==
date: Wed, 21 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 262ms
98ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&_it=amazon&partner_id=403
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3059
cf-ray: 9439d69bbcdd7bd9-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 27 May 2025 05:15:53 GMT
date: Thu, 22 May 2025 05:15:53 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 241ms
80ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 9
expires: Thu, 22 May 2025 06:15:53 GMT
date: Thu, 22 May 2025 05:15:53 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
x-amz-id-2: ARTLOF8fvdJnwyqyxlCCsrr8nEuEGjLNVvlfOIL0Dbmn9IPS8Kd6yX6w43ZN1UEzGWEll+Brz2mHqyqopOErhh8GiGDyF7PNIW65mFnCJy0=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 9JYTHC4H5NNPE555
cf-ray: 9439d69bbd4b7c7f-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 603ms
265ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 22 May 2025 05:30:53 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 22 May 2025 05:15:53 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 140ms
133ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnRQMXE5VGhZVXdCbDNqVm5TWXFDclZpeFRmS3hpRmI2ZV9sUlE2ZTlvSUk&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MnRQMXE5VGhZVXdCbDNqVm5TWXFDclZpeFRmS3hpRmI2ZV9sUlE2ZTlvSUk&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

347ms
147ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:54 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Thu, 22 May 2025 05:15:53 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=e05a3fa8-8232-480e-98a4-9a881ad621a5&bid=1e2n4ou

70 B
440 B

134ms
134ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=e05a3fa8-8232-480e-98a4-9a881ad621a5&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:54 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=e05a3fa8-8232-480e-98a4-9a881ad621a5&bid=1e2n4ou
content-length: 191
date: Thu, 22 May 2025 05:15:53 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uqjHpLNE2pUuQ31SeZ.AiYHzKaL54Zh62cw-~A&gdpr=0

70 B
440 B

315ms
133ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uqjHpLNE2pUuQ31SeZ.AiYHzKaL54Zh62cw-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:54 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-uqjHpLNE2pUuQ31SeZ.AiYHzKaL54Zh62cw-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8003961003671835830&newuser=1&referrer_pid=m51mh00

70 B
440 B

339ms
147ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8003961003671835830&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:54 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8003961003671835830&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 05:15:53 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=1835666910267394708&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

261ms
134ms

Image
image/gif

18.214.54.215
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=1835666910267394708&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 18.214.54.215 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-214-54-215.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 05:15:54 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=1835666910267394708&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: c306add9-32f6-4cc2-ad72-be02a67e1dfd
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:53 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
529 B 437ms
235ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 3466c729c0dbe1b70fa5426f6c94fa7b56f5b8675d618fa5dccf5a94665e21a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/json
x-cloud-trace-context: a096d3e01d2bc27d21ef2a544a9efcaf
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 1B2E 20 KB
7 KB 134ms
133ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=170801
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 05:15:53 GMT
expires: Sat, 24 May 2025 04:42:34 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 1B2E 2 KB
3 KB 433ms
133ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=31149906&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 99598b2c0f08f2a2c0b5af4d64982c52c7d328baf3afa4f48408f74fcb447892

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 250ms
82ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 226
cross-origin-resource-policy: cross-origin
cf-ray: 9439d69edbeccb9a-LAX
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 22 May 2025 05:09:53 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
264 B 96ms
94ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58663da8f2f6db1184e9cc89b579167dd24251fae2ab8babdd9a86e9bc2fd393

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9439d69f7870295e-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 263ms
96ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 9439d69ede49295e-LAX
content-length: 0
content-type: text/plain
date: Thu, 22 May 2025 05:15:54 GMT
expires: Fri, 22 May 2026 05:15:54 GMT
server: cloudflare

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 137ms
133ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:53 GMT
content-type: application/octet-stream
server: nginx/1.24.0

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 226ms
224ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

40c9dfe2ead2526f05c357db5e7c607309933c0f971c26f540d6c5aa6879962b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json
vary: Origin

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 134ms
134ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 22 May 2025 05:30:54 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 22 May 2025 05:15:54 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 ad_ Show response
fundingchoicesmessages.google.com/f/AGSKWxXEl3ioKWOjzsDCqjaYbfArJBFVimDSlFCNvCdi7EjOo2tYN_tIfN1ltYNXPVIm1ucv-PUPUZrGGzvOlbxMW5XakJvYci1Y7eecSShgTFTxIIjpGV0hf6p8UcoFhMhorMZUAzullmL7N-86cKO8py_VH9vPw... 54 B
109 B 178ms
178ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXEl3ioKWOjzsDCqjaYbfArJBFVimDSlFCNvCdi7EjOo2tYN_tIfN1ltYNXPVIm1ucv-PUPUZrGGzvOlbxMW5XakJvYci1Y7eecSShgTFTxIIjpGV0hf6p8UcoFhMhorMZUAzullmL7N-86cKO8py_VH9vPwrgMEDv6gRspYpDhMEtXFhTAauKwGGZj/_/adv-scroll-/adtag./ads.min.js/photo728ad./home/ad_

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3bffb06bedb89c9184a5970fe3e0cf5be52d3ce741bd2fbbac63c89c0f547855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FUseEDYHXq6VOBLVIy62OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCBes_EW61YgbtK-zdoFxGZ-t1ntgFiIm6Pr2a6DbAIz7lzxUNJIyi-MT87PKynKTCotyS9KS05LLU4tKkstijcyMDI1MDUy0DMwiC8wAADBC0Li"
content-security-policy: script-src 'report-sample' 'nonce-FUseEDYHXq6VOBLVIy62OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 68 KB
25 KB 454ms
136ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

69df9520e73d741f328f7a40e279710499d1e2af1a81de60b2be855802f0745c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 69234120874071566
age: 203
x-content-type-options: nosniff
expires: Thu, 22 May 2025 06:12:31 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 05:12:31 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 25553
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxVXTQW2Lgjllmtm_oTHa3YZe2lEFQ3O1KzkIvNnOhDC2Os7cYBX-QA9JkVkxyuBfiMxT9ptyWx2UP8M1KcStV6D0l9z4gX8-vobQkGL6I-mvhbKv2vG41hiDjG_6TbeXLUBa9w4JA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 308ms
155ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVXTQW2Lgjllmtm_oTHa3YZe2lEFQ3O1KzkIvNnOhDC2Os7cYBX-QA9JkVkxyuBfiMxT9ptyWx2UP8M1KcStV6D0l9z4gX8-vobQkGL6I-mvhbKv2vG41hiDjG_6TbeXLUBa9w4JA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O3XAq7VQzR72ODvhyXvFUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0pBi-FB_mfUHEJv53Wa1A2IhHo6uZ7sOsgl8OLimg1HJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRqYGhnoGZjGFxgAAJylJ4M"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-O3XAq7VQzR72ODvhyXvFUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 224ms
224ms Fetch
text/plain 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 678ms
220ms Fetch
application/json 2001:41d0:701:1000::4f7d
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::4f7d , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 46b7fcda9a0a7b5397a6bbfbd63545b5b46cb90a4bde6268c62032701691f4a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 227ms
223ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

815c6e7ae2d7690a4a286267010e7f5f9db08c536967b5954a84f16fede27b09

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
12 KB 83ms
79ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?partner_id=403&sync=1&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3037
cf-ray: 9439d6a0f9587bd9-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 27 May 2025 05:15:54 GMT
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 259ms
94ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4af0201bfad6850f79c15d51f5dd2a2c0ebeb3f2816a5f7cef0006c8bda682b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 203
cf-ray: 9439d6a1fd3b2a91-LAX
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 22 May 2025 05:11:23 GMT

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 295ms
97ms Image
text/html 54.70.143.87
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.143.87 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-143-87.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&adnxs_id=1835666910267394708&gdpr=0

43 B
95 B

118ms
118ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&adnxs_id=1835666910267394708&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a39e212f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&adnxs_id=1835666910267394708&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fbed165e-0a6e-462e-97fd-d828ef5e1ad4
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001747890954-9KG74NQR-SZBH%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001747890954-9KG74NQR-SZBH%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=fa02c522-94f5-46e5-867b-cc51bf3e8a92&id=AU1D-0100-001747890954-9KG74NQR-SZBH&auid=AU1D-0100-001747890954-9KG74NQR-SZBH

43 B
95 B

124ms
123ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=fa02c522-94f5-46e5-867b-cc51bf3e8a92&id=AU1D-0100-001747890954-9KG74NQR-SZBH&auid=AU1D-0100-001747890954-9KG74NQR-SZBH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a31d8d2f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=fa02c522-94f5-46e5-867b-cc51bf3e8a92&id=AU1D-0100-001747890954-9KG74NQR-SZBH&auid=AU1D-0100-001747890954-9KG74NQR-SZBH
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:53 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001747890954-9KG74NQR-SZBH
https://ids.ad.gt/api/v1/pbm_match?pbm=624F0835-8CB9-4AF5-AF1F-8430D89589C3&id=AU1D-0100-001747890954-9KG74NQR-SZBH

43 B
95 B

116ms
116ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=624F0835-8CB9-4AF5-AF1F-8430D89589C3&id=AU1D-0100-001747890954-9KG74NQR-SZBH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a37dfc2f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=624F0835-8CB9-4AF5-AF1F-8430D89589C3&id=AU1D-0100-001747890954-9KG74NQR-SZBH
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:54 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001747890954-9KG74NQR-SZBH&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&rub=MAYX57JP-9-80BI&gdpr=0

43 B
95 B

122ms
122ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&rub=MAYX57JP-9-80BI&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a38dff2f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&rub=MAYX57JP-9-80BI&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 207e6e3bf58d030312efc0c602ea89b7
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001747890954-9KG74NQR-SZBH&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=e05a3fa8-8232-480e-98a4-9a881ad621a5&id=AU1D-0100-001747890954-9KG74NQR-SZBH

43 B
170 B

245ms
119ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=e05a3fa8-8232-480e-98a4-9a881ad621a5&id=AU1D-0100-001747890954-9KG74NQR-SZBH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a25c932f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=e05a3fa8-8232-480e-98a4-9a881ad621a5&id=AU1D-0100-001747890954-9KG74NQR-SZBH
content-length: 259
date: Thu, 22 May 2025 05:15:54 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001747890954-9KG74NQR-SZBH&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001747890954...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001747890954-9KG74NQR-SZBH&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001747...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=66ef7520-0d87-48f9-86ee-28cc4c8e457e%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=66ef7520-0d87-48f9-86ee-28cc4c8e457e%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&tapad_id=66ef7520-0d87-48f9-86ee-28cc4c8e457e

43 B
95 B

116ms
116ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&tapad_id=66ef7520-0d87-48f9-86ee-28cc4c8e457e
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a46f352f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&tapad_id=66ef7520-0d87-48f9-86ee-28cc4c8e457e
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 22 May 2025 05:15:54 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 149ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001747890954-9KG74NQR-SZBH

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001747890954-9KG74NQR-SZBH
https://ids.ad.gt/api/v1/amo_match?turn_id=8003961003671835830&id=AU1D-0100-001747890954-9KG74NQR-SZBH

43 B
94 B

210ms
121ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=8003961003671835830&id=AU1D-0100-001747890954-9KG74NQR-SZBH
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a25c912f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=8003961003671835830&id=AU1D-0100-001747890954-9KG74NQR-SZBH
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 05:16:12 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&uid=614ba7ab-1cec-4e4f-8da9-526ac6495555&gdpr=0

43 B
95 B

122ms
122ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&uid=614ba7ab-1cec-4e4f-8da9-526ac6495555&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a36dde2f4a-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747890954-9KG74NQR-SZBH&uid=614ba7ab-1cec-4e4f-8da9-526ac6495555&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 05:15:54 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-20
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001747890954-9KG74NQR-SZBH
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzg5MDk1NC05S0c3NE5RUi1TWkJI

170 B
188 B

149ms
149ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzg5MDk1NC05S0c3NE5RUi1TWkJI

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 9439d6a25c8d2f4a-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzg5MDk1NC05S0c3NE5RUi1TWkJI
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 443ms
137ms XHR
application/json 2606:ae80:1451:18::1780
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:18::1780 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 22 May 2025 05:45:54 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/json
vary: origin
server: nginx

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVXTQW2Lgjllmtm_oTHa3YZe2lEFQ3O1KzkIvNnOhDC2Os7cYBX-QA9JkVkxyuBfiMxT9ptyWx2UP8M1KcStV6D0l9z4gX8-vobQkGL6I-mvhbKv2vG41hiDjG_6TbeXLUBa9w4JA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0DWUbzJM5awHqkPO3FMSJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII0pBi-FB_mfUHEJv53Wa1A2IhHo6uZ7sOsgmcaH33gFHJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRqYGhnoGZjGFxgAALGnJ8k"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-0DWUbzJM5awHqkPO3FMSJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame CBA3
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=0&gdpr_consent=

35 B
600 B

133ms
133ms

Document
image/gif

185.167.164.52
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 22 May 2025 05:15:54 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 22 May 2025 05:15:54 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame EB9F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=624F0835-8CB9-4AF5-AF1F-8430D89589C3&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=624F0835-8CB9-4AF5-AF1F-8430D89589C3&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

153ms
153ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=624F0835-8CB9-4AF5-AF1F-8430D89589C3&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 22 May 2025 05:15:54 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: SF37GC8PCBXXVX3NX0KK

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 22 May 2025 05:15:54 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=624F0835-8CB9-4AF5-AF1F-8430D89589C3&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 8QQQXDV96HDC9FDYE2YM

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 0D60
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1835666910267394708&gdpr=0&gdpr_consent=

42 B
218 B

314ms
135ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1835666910267394708&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 05:15:55 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 5cf5aa6c-7fb3-4fc0-a370-c7f4eb3e2b7f
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:15:54 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1835666910267394708&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.246; 162.245.206.246; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 2E24 0
835 B 230ms
156ms Document
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=624F0835-8CB9-4AF5-AF1F-8430D89589C3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9439d6a1afbecb7d-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 05:15:54 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747890954&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ILcktoFH2O%2FwJlFyvHX6BJF4eocEt7EmP44UarieFqA%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747890954&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=ILcktoFH2O%2FwJlFyvHX6BJF4eocEt7EmP44UarieFqA%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 1B2E
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=624F0835-8CB9-4AF5-AF1F-8430D89589C3
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8684a321-d03e-4f79-8af9-58f291da244e

42 B
319 B

119ms
118ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8684a321-d03e-4f79-8af9-58f291da244e
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=8684a321-d03e-4f79-8af9-58f291da244e
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:53 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame 1B2E
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-YqFKgU9E2pT83htxeXiegpbUkfntcb25bw--~A&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=c2c0d898906c07539b3de3792832b092&gdpr=0
https://bidberry.net/?partner=1&mapped=652ec5d79dd01d54&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=544046d65bd574e78f74e7049e925ef4&gdpr=0&redirect=

35 B
245 B

236ms
235ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=544046d65bd574e78f74e7049e925ef4&gdpr=0&redirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=544046d65bd574e78f74e7049e925ef4&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
pragma: no-cache

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame 1B2E
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=624F0835-8CB9-4AF5-AF1F-8430D89589C3&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=624F0835-8CB9-4AF5-AF1F-8430D89589C3&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=624F0835-8CB9-4AF5-AF1F-8430D89589C3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=e05a3fa8-8232-480e-98a4-9a881ad621a5
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=e05a3fa8-8232-480e-98a4-9a881ad621a5
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=1835666910267394708&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=8003961003671835830&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
152 B

241ms
239ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aC6zDQAAK18VjgBZ
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1747890958.777728,VS0,VE0
age: 1017
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/png
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 22

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aC6zDQAAK18VjgBZ
x-timer: S1747890957.224526,VS0,VE92
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjI0RjA4MzUtOENCOS00QUY1LUFGMUYtODQzMEQ4OTU4OUMz&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

366ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 1B2E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Yk8INYy5SvWvH4Qw2JWJww%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

4 KB
4 KB

135ms
135ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=170800
content-encoding: gzip
expires: Sat, 24 May 2025 04:42:34 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 22 May 2025 05:15:54 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

492ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 22 May 2025 05:15:54 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:E78276D2CDFA458E95A43F36C1723015

42 B
513 B

383ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:E78276D2CDFA458E95A43F36C1723015
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:E78276D2CDFA458E95A43F36C1723015
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 21 May 2025 05:15:54 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e05a3fa8-8232-480e-98a4-9a881ad621a5&gdpr=0&gdpr_consent=

42 B
541 B

446ms
136ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e05a3fa8-8232-480e-98a4-9a881ad621a5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e05a3fa8-8232-480e-98a4-9a881ad621a5&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 22 May 2025 05:15:54 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8RHeDUZE2uVKt4yR7.arPiVkjIm.T4w-~A&gdpr=0

0
260 B

436ms
134ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8RHeDUZE2uVKt4yR7.arPiVkjIm.T4w-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-8RHeDUZE2uVKt4yR7.arPiVkjIm.T4w-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html
server: ATS

GET
H2 200 624F0835-8CB9-4AF5-AF1F-8430D89589C3
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 1B2E 43 B
519 B 438ms
155ms Image
image/gif 2600:1f18:4e9:5a02:3d06:6288:a6e4:f751
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/624F0835-8CB9-4AF5-AF1F-8430D89589C3?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:3d06:6288:a6e4:f751 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 22 May 2025 05:15:54 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1B2E
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4&gdpr=0&gdpr_consent=

1 B
255 B

137ms
136ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: 1c52ede7-f12d-4a71-ab71-e1baeafde615
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Thu, 22 May 2025 05:15:55 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVXTQW2Lgjllmtm_oTHa3YZe2lEFQ3O1KzkIvNnOhDC2Os7cYBX-QA9JkVkxyuBfiMxT9ptyWx2UP8M1KcStV6D0l9z4gX8-vobQkGL6I-mvhbKv2vG41hiDjG_6TbeXLUBa9w4JA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-lbfJxt8IYvxagmwHxra8gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1JBi-FB_mfUHEJv53Wa1A2IhHo6uZ7sOsglsWDZzP5OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLQMzCNLzAAAI9DJ1Q"
content-security-policy: script-src 'report-sample' 'nonce-lbfJxt8IYvxagmwHxra8gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVXTQW2Lgjllmtm_oTHa3YZe2lEFQ3O1KzkIvNnOhDC2Os7cYBX-QA9JkVkxyuBfiMxT9ptyWx2UP8M1KcStV6D0l9z4gX8-vobQkGL6I-mvhbKv2vG41hiDjG_6TbeXLUBa9w4JA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rywDCbpmv9DVMu5ijOVgtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0pBi-FB_mfUHEJv53Wa1A2IhHo6uZ7sOsgk8eHFxP5OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLQMzCNLzAAAL2HJ_c"
content-security-policy: script-src 'report-sample' 'nonce-rywDCbpmv9DVMu5ijOVgtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxWzJunB2pKkE3gPZwGzCvd0Oav0R3A7ukIQutpDfF_zj5lw2QqWIalAT7-ribcVF_QCFHfQSQ0R3EnLgI96baCHYVQIN1sATpRxo-x3c6W0eZNRWqLouRj8H0KqjMfIvW7xH4v2qw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 182ms
182ms Script
application/javascript 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWzJunB2pKkE3gPZwGzCvd0Oav0R3A7ukIQutpDfF_zj5lw2QqWIalAT7-ribcVF_QCFHfQSQ0R3EnLgI96baCHYVQIN1sATpRxo-x3c6W0eZNRWqLouRj8H0KqjMfIvW7xH4v2qw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3ODkwOTU0LDU4OTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJvYUs3YUZvX2YtVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzZGd3c3EuZGlydGNoaWN2dC5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c682e29b8973c58600ab4ec4d313085e05ee6e9c289d0ce115e912f6018f4324

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L5kjzdh4asR_d7pMCrPNOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCBes_EW61YgbtK-zdoFxGZ-t1ntgFiIh6Pr2a6DbAIvPjw8zaSkkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAAIVFD2Q"
content-security-policy: script-src 'report-sample' 'nonce-L5kjzdh4asR_d7pMCrPNOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 324 KB
113 KB 152ms
151ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

945f24b1aade33b52dce502bc482caaef66810cfc6544f4746f96452358697f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 05:15:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 116138
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 116ms
113ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a2a838cb9a-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 289ms
116ms Script
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a3bbfc83f1-LAX
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:54 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 846 B
279 B 127ms
126ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 141d10313b6ea1bc7c17c3a93bc1a609c3a48dbfcd27db311e892bb2eeac9f99

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 9439d6a47ef5090c-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:55 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 295ms
122ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 9439d6a3be09090c-LAX
date: Thu, 22 May 2025 05:15:54 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame B829 0
100 B 304ms
97ms Document
text/plain 52.42.205.133
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.42.205.133 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-42-205-133.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Thu, 22 May 2025 05:15:54 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

POST
H3 204 AGSKWxXnpN5sXkEbHPjK4Ft7wOwXh1RN4GYewhKhXPQFi8Mhi5hzkuMyu7rSEQAgWYMZcbT7XZ_Z9C4X6S1wS5tOt1K2MuVmAibZAeCEzs0Vp7VZLVEKNJqi3ieyZy4PPg3AuTB7TBOC5w== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 159ms
158ms XHR
text/html 142.251.40.174
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXnpN5sXkEbHPjK4Ft7wOwXh1RN4GYewhKhXPQFi8Mhi5hzkuMyu7rSEQAgWYMZcbT7XZ_Z9C4X6S1wS5tOt1K2MuVmAibZAeCEzs0Vp7VZLVEKNJqi3ieyZy4PPg3AuTB7TBOC5w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Cvjo8BMyyFaa9STX9tGXVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:54 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw0JBi-FB_mfUHEJv53Wa1A2IhHo6uZ7sOsgl8OP5oJrOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLQMzCNLzAAALWNJ9g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Cvjo8BMyyFaa9STX9tGXVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 133ms
133ms Script
application/javascript 23.201.174.84
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.174.84 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-201-174-84.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 22 May 2025 05:30:54 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 22 May 2025 05:15:54 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 426ms
132ms Image
text/plain 52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 225ms
224ms XHR
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

67a5ebb998298ba2a72096fe70888764562aaa5505feb6d31b523c81480d8af2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: application/json
vary: Origin

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 946E 5 KB
2 KB 259ms
91ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1639
apigw-requestid: K8ooQjiKvHcESIA=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9439d6a66a861035-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 05:15:55 GMT
last-modified: Thu, 22 May 2025 02:11:26 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H2

200

9.gif
id5-sync.com/cq/483/124/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*9i11bpCTYek8m_kYwNkx1z6XIzwPX_DlFk4ckLeWAescKxEkyKkaE78KcI7Nnpod&gdpr_consent=undefined&gdpr=false
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F7%2F2.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/7/2.gif?puid=fddb9f14-ed51-4b23-bf29-a02dbb7cf757&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F6%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/6/3.gif?puid=66ef7520-0d87-48f9-86ee-28cc4c8e457e&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F5%2F4.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/5/4.gif?puid=614ba7ab-1cec-4e4f-8da9-526ac6495555&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttl=%%TTL%%
https://ce.lijit.com/merge?pid=27&3pid=e05a3fa8-8232-480e-98a4-9a881ad621a5&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F3%2F6.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/3/6.gif?puid=Ks67ALZHO5BChF1IQIWxNgUT&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/2/7.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/2/7.gif?puid=1835666910267394708&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F1%2F8.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/1/8.gif?puid=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c757BYkhsKmBuUFVw3GOq41jZZpFsLyDVFzJIoxBsg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F0%2F9.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-c757BYkhsKmBuUFVw3GOq41jZZpFsLyDVFzJIoxBsg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F0%2F9.gif%3F...
https://id5-sync.com/cq/483/124/0/9.gif?puid=f921158c-ac55-4d34-93ba-7188ceae505a&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

43 B
1 KB

224ms
224ms

Image
image/gif

57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/cq/483/124/0/9.gif?puid=f921158c-ac55-4d34-93ba-7188ceae505a&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 05:15:59 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

access-control-allow-origin: *
location: https://id5-sync.com/cq/483/124/0/9.gif?puid=f921158c-ac55-4d34-93ba-7188ceae505a&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 05:16:00 GMT
content-type: text/plain

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 165ms
163ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 9439d6a8d97ae9e0-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:55 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 260ms
119ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 9439d6a81f3ce9e0-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:15:55 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 946E 0
140 B 260ms
117ms Ping
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 9439d6a9c9502ea9-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 05:15:55 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 262ms
121ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9439d6a828ccf7c5-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:15:55 GMT
server: cloudflare
vary: Origin

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 105 KB
40 KB 536ms
535ms Fetch
text/plain 142.250.80.34
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=87118412380911&correlator=935605660563281&eid=31086814%2C95353384%2C31092563%2C83321254&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-44&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1747890955394&lmt=1747890955&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KnJ5bjRtOG1YN0J4bG4zVHRtZDI4SW1lVHJzbFdXMzBRVDBxUlplNlNqQjRjS185UVpYbEVONFp0WmZESUEza0pYARI0CgpwdWJjaWQub3JnEiQzN2ZmNzgxMC04YjI1LTRmNzEtODhmNS0yZWQxNWY4OGMxNGVYARI3Cg1iaWRzd2l0Y2gubmV0EiRmNzI2ZGQzZi1hY2QwLTRlYmItYTg2Mi1lMjQyZTE0MDQzZDhYARIdCg5lc3AuY3JpdGVvLmNvbRjotq2z7zJIAFICCGQSGAoJeWFob28uY29tGMm6rbPvMkgAUgIIbxLuAQoIcnRiaG91c2US2AFmbXhSMGZhS3dEWk52em43Tk13YlRsamtBVWY2d2s2SUowQndkYmRjWXhYMnlNdmx5eTM5ZklQNGRnZlV4NVRBekowY3F2V1JCSTRCWnFOVWdIM3JrODl5SDA0SDRqVmVLZGxoQzdidllScnYzZkVsSUJXalFVUGxGUGZuTU02MDJsNU9jREFXNktHbllwVXFtSTlRck5sQWdGTS8zek9LVEhoSHpxQy95TkxSVHQrdy9wamdBbzQ5RVMyVkUvY3E5MU1tRytlRm1HcDd5dEJCYkw3MHdRPT0Y0L2ts-8ySAASFAoFb3BlbngYqLmts-8ySABSAghvEhsKDDMzYWNyb3NzLmNvbRjotq2z7zJIAFICCGQShwEKDmxpdmVpbnRlbnQuY29tEnMxNS1GN2U2TzNxWDc5eWxub1U2YVVFM3ZvZGV2WUxycHFzRm05RzZvNUg4enlSYmlEWEZhOU1CeDh4RjBZRFdXM21vVUhwYWFVVmdaRFJYdHhSNlB2Q2lqcElmamxCMFA3ZlBpMWRwWTIyL0FpL0pVdz09WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1747890950218&idt=1992&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D79d0403d397b455198f35cbedec4bfbb90953183%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_format_grid%3Dbanner%26hb_size_grid%3D160x600%26hb_pb_grid%3D0.23%26hb_adid_grid%3D1338d5494eb37608%26hb_bidder_grid%3Dgrid%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.23%26hb_adid%3D1338d5494eb37608%26hb_bidder%3Dgrid%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e1%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fsdgwsq.dirtchicvt.com%252F%26tyche_code%3DV.20250515.1%26pageos_code%3DV.20250515.1%26config_id%3D1024872_74068_primary_config%26hour%3D19%26day%3DWednesday%26referrer_domain%3Dsdgwsq.dirtchicvt.com%26OS%3DLinux%2520null%26browser%3DChrome%2520136%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250515.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=49452&tan=ae760d02-680b-46be-9add-38595036708c&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d1c936c1b1d3353bf00adcd4393ea49b8b3e78d223c6357e3c7f6d57c325dae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 40648
x-xss-protection: 0
server: cafe

GET
H2 200 container.html Show response
ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/ Frame 1A28 7 KB
3 KB 442ms
149ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 05:15:55 GMT
expires: Thu, 22 May 2025 05:15:55 GMT
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 262ms
258ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:55 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 5672 4 KB
5 KB 421ms
137ms Document
text/html 157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 2abd3c6210d9ab7567f61e9bd9bb9606329a9e34aed4d86b9c66fd75ff4d5702

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4157
content-type: text/html
date: Thu, 22 May 2025 05:15:55 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 584ms
380ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 setuid
prebid.intergient.com/ Frame 5672 0
907 B 163ms
156ms Image
text/html 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=52fd7896-c310-39e3-7136-d817179fe9b4
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747890955&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1yG1gAVOL8ymwLn7XLCcdjsVEcITPTjnVHzIy6bInCs%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 05:15:55 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747890955&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1yG1gAVOL8ymwLn7XLCcdjsVEcITPTjnVHzIy6bInCs%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9439d6aa59bdcb7d-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=1835666910267394708&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHwa3z6j2VRu6hPdVV&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

138ms
138ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 5672
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=10f1ff28bcf204f9&is_secure=true&networkId=17100&version=1&nuid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAAcIPTlQKsJgIspEvEAQEBAQEBAQCX92pr7gEBAQEBAQEB&expiration=1747977357&nuid=624F0835-8CB9-4A...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35392_128B343E5_766B33806&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

141ms
141ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-430895758; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-430895758; includeSubDomains
Cache-Control: no-cache
Date: Thu, 22 May 2025 05:15:57 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:58 GMT
server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_c...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=1NNY
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

144ms
143ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHO5BChF1IQIWxNgUT&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

175ms
137ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:57 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=1120465285135644919312&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHwa3z6j2VRu6hPdVV&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

144ms
142ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHUQRa-MVUQK29yqoK&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

178ms
158ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%2...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4423e7a3b26424b6&is_secure=true&networkId=17100&version=1&nuid=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQANkxKtsJ2fAgJDc8SKAQEBAQEBAQCX92pqewEBAQEBAQEB&expiration=1747977357&nuid=624F0835-8CB9-4A...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

158ms
157ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=624F0835-8CB9-4AF5-AF1F-8430D89589C3&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 177
date: Thu, 22 May 2025 05:15:57 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=788987b6-e26a-424a-8141-7b7471d024d2
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHwa3z6j2VRu6hPdVV&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

167ms
137ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:57 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-6cbfe8db-29cc-49af-8a28-52b161d28590
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

149ms
137ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=d38a7a58b675bbf7892f9fd356d4bf&_fw_gdpr=&_fw_gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8

43 B
496 B

180ms
137ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f87151913bb3c6b8
Content-Length: 0
Date: Thu, 22 May 2025 05:15:57 GMT
Etag: f87151913bb3c6b8
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5672
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3908925582888150000V10&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

137ms
137ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3908925582888150000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3908925582888150000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 22 May 2025 05:15:58 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 22 May 2025 05:15:58 GMT
Content-Type: text/html
Server: Apache

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame BCF4
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

139ms
134ms

Document
text/html

23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 05:15:56 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame BDD0 948 B
1 KB 103ms
93ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 3226e178b5739f0868386c892ae29e4002ea4f6576e941a9ff480f47b63480f4

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 948
content-type: text/html
date: Thu, 22 May 2025 05:15:55 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.246

GET
H2 200 cm Show response
us-u.openx.net/w/1.0/ Frame 5D5C 950 B
1 KB 161ms
153ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0f5e17db2b41260922f9aa588ced6ca898b693a6fce5743205822604306728fb

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 950
content-type: text/html
date: Thu, 22 May 2025 05:15:55 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.246

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame A814
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

139ms
133ms

Document
text/html

23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 05:15:56 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2 200 container.html Show response
ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/ Frame 8469 7 KB
0 0ms
0ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 05:15:55 GMT
expires: Thu, 22 May 2025 05:15:55 GMT
last-modified: Wed, 30 Apr 2025 15:53:45 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 44CE 0
0 137ms
136ms Document
text/plain 157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:56 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame F561 3 KB
2 KB 240ms
83ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 495
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9439d6ac3c7a2f67-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 05:15:56 GMT
expires: Thu, 22 May 2025 09:15:56 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame A10C 20 KB
7 KB 134ms
131ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=170798
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 05:15:56 GMT
expires: Sat, 24 May 2025 04:42:34 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 2A0E 1 KB
2 KB 225ms
138ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: df544a9671b546cd6e9cbb9a0c68f5fe27c6842d027517e29ef25de764cfa75f

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:15:56 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 3C5D 813 B
1 KB 106ms
94ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 39feb9365166ed38ff7f5ea697b4662ecee6259b892b1010ccd2d742645d94e4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Thu, 22 May 2025 05:15:55 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.246

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame C04C 269 B
379 B 449ms
131ms Document
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 05:15:56 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame D585 52 KB
17 KB 706ms
224ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 76218
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 22 May 2025 05:15:56 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2611864, 114253
X-Served-By: cache-lga21993-LGA, cache-mad2200128-MAD
X-Timer: S1747890957.607475,VS0,VE0

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame F954 11 KB
4 KB 267ms
124ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f16a48c780d824d866892c29bb844a08f3f8308b1fe79ae62891e614d0c5681f

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 9439d6ac3b8f7eb4-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 05:15:56 GMT
expires: 0
last-modified: Tue, 20 May 2025 11:23:41 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame D0B8 2 KB
1 KB 387ms
128ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 05:15:55 GMT
server: Kestrel
server-processing-duration-in-ticks: 110428
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 142ms
128ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=rDZP1F9SOUYlMkY1Wnp5TEhSQjd3S0hPanpKMFFaR2JoZTV1b3BNenFSekUlMkI5RGRhMG1yNnZ2bzc3VEFQJTJGJTJCVjdub1ZNWm1sQmx1RmE4R3JPQ2QlMkZBejVPJTJCbWhrUlRpdjdpWjhUWkxLOEZYSWdQWGxEY3NLZklrU3JQcWlIQTY0MnB6cVpCSw&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 05:15:55 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 229411
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 225ms
222ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-34-226-135-126.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:55 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 153ms
136ms Fetch
application/javascript 52.207.110.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.207.110.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-207-110-172.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: af746b4c15bc7d32354378ace550749336bdfb47a6fff5b415670416f21f2d75

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 109ms
93ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=h%2FxECXrHI9K8Vnj3KHKdZFGsVBJg502NZcpBaAertbw%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: bdc46e84d328a5c5ed72f2638e2ede88cc2208b62d2c3e71c97701de9495d509

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 178 B
0 11ms
11ms Fetch
text/plain 100.29.97.158
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jvv6pp93dvev0s1jmq92hrt9&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.29.97.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-29-97-158.compute-1.amazonaws.com
Software: /
Resource Hash: 2847c1371775cf6bec6bdea20ecb7de2553386964227657e9ab445dbd0ea284a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 77af2e47e400a905
request-time: 5
access-control-allow-credentials: true
expires: Fri, 23 May 2025 05:15:52 GMT
access-control-allow-origin: https://paint.toys
content-length: 178
date: Thu, 22 May 2025 05:15:52 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 149ms
138ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 280518
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=themediagrid&bsw_user_id=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=1NNY
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=themediagrid&bsw_user_id=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=679c479f-9ed3-45c5-8ac2-a246b1e4bf0f&ssp=themediagrid&us_privacy=1NNY

43 B
103 B

141ms
140ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=679c479f-9ed3-45c5-8ac2-a246b1e4bf0f&ssp=themediagrid&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=679c479f-9ed3-45c5-8ac2-a246b1e4bf0f&ssp=themediagrid&us_privacy=1NNY
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:57 GMT

GET
H2

200

ibs:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5

42 B
718 B

135ms
134ms

Image
image/gif

34.226.135.126
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.226.135.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-0962d78e5.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: QIN+YAAXTI0=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=e05a3fa8-8232-480e-98a4-9a881ad621a5
content-length: 189
date: Thu, 22 May 2025 05:15:56 GMT
server: Kestrel

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame BDD0
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=21cdad22-9222-42af-aa8a-9a0519e6f1fd&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHO5BChF1IQIWxNgUT&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=2828f602-b128-4859-a835-fd2d134c4a0d&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=567255ce9bbb04b4

43 B
496 B

139ms
139ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=567255ce9bbb04b4
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=567255ce9bbb04b4
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: 567255ce9bbb04b4
Server: Adtelligent

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame BDD0 170 B
243 B 153ms
152ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame BDD0 170 B
232 B 156ms
149ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmYyZDBmOGQtZDQwZS0yN2JkLWMwNjAtODJiODYyYTM4YmY2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BDD0
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=

43 B
62 B

103ms
99ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 22 May 2025 05:15:56 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BDD0
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/4785ba03-8dd5-eb50-e457-cef4571688df?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A

43 B
61 B

104ms
101ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame BDD0
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDAASvRSidAAL

85 B
149 B

243ms
241ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDAASvRSidAAL
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1747890958.777818,VS0,VE0
age: 306
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/png
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 1857

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDAASvRSidAAL
x-timer: S1747890957.684441,VS0,VE95
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame BDD0
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

111ms
108ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 05:15:56 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 144ms
140ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 5D5C
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openxut&userId=982fbb60-1dd6-457a-bf05-c7c65fed65c4&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Ks67ALZHO5BChF1IQIWxNgUT&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=06f240bb4009cf49

43 B
496 B

139ms
138ms

Image
image/avif

157.230.92.35
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=06f240bb4009cf49
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 157.230.92.35 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=06f240bb4009cf49
Content-Length: 0
Date: Thu, 22 May 2025 05:15:56 GMT
Etag: 06f240bb4009cf49
Server: Adtelligent

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 5D5C 170 B
232 B 279ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 5D5C 170 B
232 B 274ms
156ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZmYyZDBmOGQtZDQwZS0yN2JkLWMwNjAtODJiODYyYTM4YmY2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5D5C
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=

43 B
62 B

100ms
97ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e05a3fa8-8232-480e-98a4-9a881ad621a5&ttd_puid=d342dc47-1d79-7919-d580-d801a8414596&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 22 May 2025 05:15:56 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5D5C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/4785ba03-8dd5-eb50-e457-cef4571688df?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A

43 B
61 B

110ms
109ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-ftNBLsNE2p88nWWCNP1EXV.C5R.q8ERrm0U-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 5D5C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDQAKQV7nxAA_

85 B
192 B

225ms
222ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDQAKQV7nxAA_
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1747890958.123645,VS0,VE0
age: 307
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/png
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 1858

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC6zDQAKQV7nxAA_
x-timer: S1747890958.771213,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
x-served-by: cache-toj-leto2350040-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5D5C
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

114ms
114ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8003961003671835830&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 05:15:55 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A554 652 B
254 B 427ms
156ms Document
text/html 142.250.65.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCnlAEQj8-UARjKtfW4AjAB&v=APEucNWrW8coPBANa-RcJNoG56h6hfK0QAcyj8LiYXPqQ7LZBo222TWRr0vG1SvsYFFrF0ECWcoFogPr8LT_lP7VeKkUCkxm1bFOHv-kD9g01UlC1wJKc9E

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 05:15:56 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 8469 477 KB
96 KB 479ms
154ms Script
text/javascript 2600:141b:1c00:44::17db:2445
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: sdgwsq.dirtchicvt.com
URL: https://sdgwsq.dirtchicvt.com/xqxl4xpxx8bvtu90lz7rs4svRWmJ4S1NVaTZzR0xlMG93cVZTSWotMzA5Ny0yNjc1MTI5My0xMDA1MDI3Ny00NzMwLWFrMEh1YTFEVlhickx1NzFIWXNl/ri119f4v6m8/kfHzAvwCQvhyND/628861079866131842903446331934249
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:2445 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 7a5311755b6acbc4a85a705a6309c0f178f27270aedf665303cea44f51e304b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "cf0f10366b0f49a4cb1227f621ef359f"
Connection: keep-alive
Expires: Thu, 22 May 2025 05:30:56 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 97521
Date: Thu, 22 May 2025 05:15:56 GMT
Last-Modified: Wed, 21 May 2025 12:49:28 GMT
Content-Type: text/javascript

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/ Frame 8469 22 KB
8 KB 639ms
346ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aafb777c59d54093f12d271484c6ed79b3c4b85703df5ac5c567993f0509c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 8838669320932718355
age: 44085
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:01:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:01:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8654
x-xss-protection: 0
server: cafe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/elements/html/ Frame 8469 8 KB
3 KB 453ms
163ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250520/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 567199331036499589
age: 43892
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 17:04:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 17:04:24 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 8469 0
0 325ms
171ms Fetch
image/png 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssy1lCJ8GoqycpF8uSX9-gFxRqDuU9RzR_h3kFQTN5C_k3_pJIYzeljvte-wmUr_o9mGm1-xqlRfwROiZWtTFbtvyq5N8jFTPBxislIMOdCa2q9YlxUwlqsVEJYUjqCeu0n6WSJtS1DePQD_08jyku71ByGEgyKhFa-Vh3Pw7gkOuKJrCGM7cj5-S8VbDXTBtY6SwvdU5MLpxOzlEU5drIFsPQH8tNqLJfDMtKAa9uRJNyHiIuwxng4jIs467aPont8_Lm5ubHPZkTu6xiyqhkQDg1broCqEJ4XduL7-bOfVJzRuupRqw6b-dCGnq6aIivfxFqpRagyGuXFcy4XExangfpp-WfXCGOUL7PbLboqPB_VUUg-O53r0u4T7RFwHpuKCyevOQfhsSU-9rkHjpVch-bsDqGcpWZwRX1Zm54QG3WsSOalPH1YFF7WkeCpBXu52C_J6rj0vIMv4OrsXGjXPrAtG474-PKbXMERvEFQYzr82w8SIJ8MqKAHLhjpgu-Wcb_fQ-W_3d-zdaKDlr7H-vv2fRsHe34OK2wlUXAnmzJmP0eaT6Dn-UNu2hao_GKLQAL1TsTc5hiFFwQ60aQ-i8gLOj3s721oCZkNcZOzTDsDyn13E_YpNMiv_pmXH4cQASdZZTrec75wVy7iP8lkxW9W0M5eGkB5MncgUEPOgVW5sxXG7qHus2QEebiKI3rjwX1YceiSZMue60f7XFlxBAqV6HijzCj8w6eMlVRqL6bsWEznVgptYrZ-26scK0QeJVaWVMyF5B58jOC8z78CxAUagZnNoGi8gTX6OY28aF7lpnwjJw8w-5K5NBXNQZBjXFseZ664M52km4YjvwHleaW7TrvenZRlzqasA0cf5cnMWE_FWBbFndYUQcWDQ-zD_3UOlUAi-j2t88v33PgjRRjtasE5n8cEyElbZUirS6J6Fz6G3vQId4KbXnJmyDVhEzts7ifWIP8A-K3uOeKwud9xUxR5dT5k2WXnjyNEzuYitQaHYXfjyzBf2B9G8filsIUQ3Q1bw-l2yo3NThQHwaObTXZLxKhcixUqZrj5w84C4CTM-HQXIQ8fCuNTmk4YMHROR4-4vlD7ropc8p07PAyN3oQJ2JXk1oQ-qPPWwNo5mWZsTwwFHGUDxbZER2TdFIR46Rquwh3mcBHyCHH2PUtpd0-j9KViP3yiTft8VQ3tEgQKh_Bn1vaSFOQzZWvmR-60CH3IL-AzJtD071cRP7iFjTy0H4XKjrNfMAKL-RTrReHkJKKMXLoEKHiQb18oMak5qgKmcHnrtAdLuMjFhLS-dGukmiticMY4mZNSVObP2wB2vSFIKa91ZJE2JKiLWIsZLYRHWt2oNHeh52Ao7vbryzJxyQgMsrMamcuDV8R1CK4fszzY3yRuG9dOu4ogcvXdjIk99vh2bGc7KHSvD7O9RicZ6WopRWd7CuKorbV-RWbVARtONCBMvSk6Mb3yzkaheTZp7asyn-GWBRQgey5-WFUOBVSSmPhtW2FqMMRcwLsWzEJBm5RKvBT3kSZfh-lNEI5462zreX11riL_QfMjKdUT6Q-CpG447ZADeey-zI-VpFrOqPsZBiQtKssLf20TIXQnyjJy_6noxCscRvBwbZfZq6hSvKZ3hhzp_pwOuRtR2rDY9EQQA42fFCgOfaCg4gMevJYw-bdzYfX0HjAK68R625nqOlXsZpxnKKLyajkmvt4974EGI7bjT0bGOEN-w6CpUJPhgYpJACysh9J5LzAoG_1HAIu5zCcJxOvCQtv0hcmq0_tNZks5W_jTWEggrridH7JsEIk6wK4b8iZHqPQBL-3nAjYGw0NmvNmTw-tfGAV5uHUnxFSlfr9ie1feqUM88Q&sai=AMfl-YRqE53wxZxN7ObGvB16lD1LvLxIqtm8B-is5HgC2mLTxagjK7RysGJLSKhgzzXwkQYQOOVF-Pk7fFPSJX9J43UdkJ8QdO8AOEtZOe2trqK7rv1f9sJxTJeQ_Kr6X14MGrCQI5NHClDpjiF6BGrLFYGUadE7hKlrkb9wh22AIdXtvKnJtJJz5XRM-yeT0YZCOd1eJPjRjAq7zgN82MFwpPAUY7RemAsMkHXjBsLrQXzz3wF396Z28gki8tHNICOwerN0CzEAgwSdYAQDLDkLEogAnVeSIDRJUDHf5GUoHnBwYA7yl8P7dVT469QL5eIFeaKPWOH43OBuBGawYZKTRptRgq4ac_TPEAdlqOMbZne6ZQPh5CrTU7UQNhqjxqp34QqpK3OrAxox_ARDGHbVB3-bjX2sgPU4286tddsfbng0sz7xoEU&sig=Cg0ArKJSzANvp0n87Qw_EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9uaWtlLmNvbQ&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20250520.81504&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Thu, 22 May 2025 05:15:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"908705256":"0xa1c998f4727b27530000000000000000","908705257":"0x60396e398f4d01120000000000000000","908705258":"0xa50fcf9a7e6ffcf70000000000000000"},"debug_key":"17782854960253074723","debug_reporting":true,"destination":["https://nike.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["1350256"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4171764"]},"max_event_level_reports":2,"priority":"0","source_event_id":"5589957015139109463"}
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 8469 41 KB
14 KB 446ms
137ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 412
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 22 May 2025 05:59:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:09:04 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 8469 3 KB
1 KB 575ms
267ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/window_focus_fy2021.js

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 44162
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 16:59:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 16:59:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DAD2 1 KB
643 B 434ms
153ms Document
text/html 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 54334
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 21 May 2025 14:10:22 GMT
etag: 48472445140208031
expires: Thu, 22 May 2025 14:10:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/ Frame 8469 19 KB
8 KB 476ms
170ms Script
text/javascript 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250520/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00cb7954e81964a084d2b6be31d34dec7e5bc75ce1e5eba690b3cc0b0640b5a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 9135495209924228279
age: 44162
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 16:59:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 21 May 2025 16:59:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8097
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8469 42 B
63 B 655ms
376ms Image
image/gif 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CCW4U-FcnCyuGBA7x2ZH19DMaewyNdcmoMdDOO6HZ5mcRCJdtv5tsPdqO2GYkskoY66Yfmrk3n1068fGkw_5Zfia0gJcD_midZ2MnC9m2ng4fXAik

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET l
www.google.com/ads/measurement/ Frame 8469 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 8469 221 KB
68 KB 438ms
160ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9fc89654aff6bca6c890b30bd0833eb2f18d63a61c0a9ece5246537ad6f73c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 81102085050987160
age: 579
x-content-type-options: nosniff
expires: Thu, 22 May 2025 06:06:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 05:06:17 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69707
x-xss-protection: 0
server: cafe

GET
H2 200 12990024383877446672
s0.2mdn.net/simgad/ Frame 8469 121 KB
122 KB 443ms
138ms Image
image/jpeg 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12990024383877446672

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

353b89a6874ebd1e2793a3db2357c99655042ff3000b09e7e01dc51fa60f7bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

age: 36579
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 21 May 2026 19:06:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 21 May 2025 19:06:17 GMT
last-modified: Mon, 05 May 2025 19:28:07 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 124205
x-xss-protection: 0
server: sffe

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C5D
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1835666910267394708

43 B
61 B

107ms
105ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=1835666910267394708
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=1835666910267394708
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: dd13e6b2-612a-45ca-85c1-44ce9daa225f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 3C5D
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=8684a321-d03e-4f79-8af9-58f291da244e
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

121ms
121ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 3C5D 95 B
765 B 254ms
105ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=d53cafbb-467e-449e-9f61-40d79bcd849a

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C5D
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=6db47774-fab5-459c-a570-53028a2f3928-682eb30c-5553&gdpr=0&gdpr_consent=

43 B
61 B

141ms
140ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=6db47774-fab5-459c-a570-53028a2f3928-682eb30c-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=6db47774-fab5-459c-a570-53028a2f3928-682eb30c-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 3C5D
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4

43 B
61 B

110ms
109ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 0b16d7e2-34d3-4eea-b53d-4771cdbac4fb
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=9bbdc5ee-9ab0-4ee1-8241-5aa1d8687ed4
Content-Length: 112
Date: Thu, 22 May 2025 05:15:56 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 3C5D
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=DBRWe7T_wDcz9JS2e1h_LA==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

113ms
105ms

Image
image/gif

35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

xuid
eb2.3lift.com/ Frame 2A0E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=e05a3fa8-8232-480e-98a4-9a881ad621a5&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

151ms
149ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=e05a3fa8-8232-480e-98a4-9a881ad621a5&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=e05a3fa8-8232-480e-98a4-9a881ad621a5&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 22 May 2025 05:15:56 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 2A0E 170 B
232 B 152ms
151ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2A0E
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTEyMDQ2NTI4NTEzNTY0NDkxOTMxMg%3D%3D

170 B
188 B

155ms
153ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTEyMDQ2NTI4NTEzNTY0NDkxOTMxMg%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216659.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTEyMDQ2NTI4NTEzNTY0NDkxOTMxMg%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 05:15:56 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 2A0E
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTEyMDQ2NTI4NTEzNTY0NDkxOTMxMg%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

142ms
134ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 2A0E 0
249 B 434ms
198ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1120465285135644919312&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 0CF5F9415AF3411C9204594845B3B7C7 Ref B: LAX311000111031 Ref C: 2025-05-22T05:15:56Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1spOTKxglwuoyNO+CgQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 22 May 2025 05:15:55 GMT

GET
H2

200

sync
thrtle.com/ Frame 2A0E
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1120465285135644919312
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=651dfc59-eed8-402f-8987-5c6d2c78d190&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=651dfc59-eed8-402f-8987-5c6d2c78d190&vxii_pid=12&vxii_pid1=7006&vxii_rcid=2620c1ef-d66d-4ff9-b77a-816992b04c38&vxii_rmax=3
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1747890957%26_reach%3D1
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1835666910267394708&vxii_ts=1&_t=1747890957&_reach=1
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-vODSYkNE2oSwgS9POvkOPhPLlpjSloftnsgJMw--~A

43 B
538 B

133ms
129ms

Image
image/gif

54.175.109.165
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-vODSYkNE2oSwgS9POvkOPhPLlpjSloftnsgJMw--~A
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 54.175.109.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-175-109-165.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Thu, 22 May 2025 05:15:58 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-vODSYkNE2oSwgS9POvkOPhPLlpjSloftnsgJMw--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 05:15:58 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame 2A0E
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1120465285135644919312?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-DHDV_O9E2oRTYkQXM87N7RPGMJYKKJY3RYEUuY_FDg--~A&dongle=0883

37 B
474 B

149ms
137ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-DHDV_O9E2oRTYkQXM87N7RPGMJYKKJY3RYEUuY_FDg--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-DHDV_O9E2oRTYkQXM87N7RPGMJYKKJY3RYEUuY_FDg--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 2A0E 42 B
692 B 338ms
103ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1120465285135644919312&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: 109030038A574C2D9DC2EFB4B6D5E9F5 Ref B: LAX311000108033 Ref C: 2025-05-22T05:15:56Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 22 May 2025 05:15:55 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 2A0E
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=4e6726aee65b140a&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHs5CFP7Hg4gJ6CgKwAQEBAQEBAQCX92pr6wEBAQEBAQEB&expiration=1747977357&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

142ms
141ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHs5CFP7Hg4gJ6CgKwAQEBAQEBAQCX92pr6wEBAQEBAQEB&expiration=1747977357&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHs5CFP7Hg4gJ6CgKwAQEBAQEBAQCX92pr6wEBAQEBAQEB&expiration=1747977357&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 2A0E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=1gDK_ykXsUqrqyu0sdGP3nC9g5DYyd6O_Kk5AiMdHvP2_gE&dongle=4430

37 B
474 B

150ms
149ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=1gDK_ykXsUqrqyu0sdGP3nC9g5DYyd6O_Kk5AiMdHvP2_gE&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=1gDK_ykXsUqrqyu0sdGP3nC9g5DYyd6O_Kk5AiMdHvP2_gE&dongle=4430
Content-Length: 131
Date: Thu, 22 May 2025 05:15:56 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame F954 19 KB
7 KB 258ms
83ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 9439d6ae48937cda-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 05:15:56 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame F954 4 KB
1 KB 141ms
138ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cce94a2cfd7599431879f830301309d36d9fec0787e02496c3510f88fb3498e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9439d6ad4c987eb4-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 22 May 2025 05:15:56 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 228ms
225ms Fetch
application/json 141.95.98.65
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.65 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

815c6e7ae2d7690a4a286267010e7f5f9db08c536967b5954a84f16fede27b09

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 1B2E 0
260 B 418ms
132ms Script
text/plain 8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:56 GMT
server: nginx

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 290ms
148ms Fetch
text/html 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js?cb=31092563
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s74-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1835666910267394708

86 B
1 KB

164ms
163ms

Image
image/png

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1835666910267394708
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747890956&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=bygMxyGOogcumkNA04BV2q7hZ2KvmYNQwA4%2BWfIFnXw%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747890956&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=bygMxyGOogcumkNA04BV2q7hZ2KvmYNQwA4%2BWfIFnXw%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9439d6aee87e0908-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1835666910267394708
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 669.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a4ef740d-570b-445f-b61c-7bc7b12110ca
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame C04C 44 KB
11 KB 151ms
138ms Script
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 31280a9ce8a84bd2572c80f84f6d075f1d07083e50beafabff62582e65aea27e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=48799
content-encoding: gzip
expires: Thu, 22 May 2025 18:49:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Thu, 22 May 2025 05:15:56 GMT
last-modified: Wed, 21 May 2025 18:49:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A814 44 KB
0 149ms
149ms Script
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 31280a9ce8a84bd2572c80f84f6d075f1d07083e50beafabff62582e65aea27e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=48799
content-encoding: gzip
expires: Thu, 22 May 2025 18:49:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Thu, 22 May 2025 05:15:56 GMT
last-modified: Wed, 21 May 2025 18:49:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame BCF4 44 KB
0 149ms
149ms Script
text/html 23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 31280a9ce8a84bd2572c80f84f6d075f1d07083e50beafabff62582e65aea27e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=48799
content-encoding: gzip
expires: Thu, 22 May 2025 18:49:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Thu, 22 May 2025 05:15:56 GMT
last-modified: Wed, 21 May 2025 18:49:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame F954
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=u40cpuw&ttd_tpi=1&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=e05a3fa8-8232-480e-98a4-9a881ad621a5

0
299 B

124ms
123ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=e05a3fa8-8232-480e-98a4-9a881ad621a5
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 9439d6aeee307eb4-LAX
expires: 0
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

location: https://elb.the-ozone-project.com/setuid?bidder=ttd&uid=e05a3fa8-8232-480e-98a4-9a881ad621a5
content-length: 215
date: Thu, 22 May 2025 05:15:56 GMT
server: Kestrel

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame A554
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1

43 B
337 B

100ms
99ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCnlAEQj8-UARjKtfW4AjAB&v=APEucNWrW8coPBANa-RcJNoG56h6hfK0QAcyj8LiYXPqQ7LZBo222TWRr0vG1SvsYFFrF0ECWcoFogPr8LT_lP7VeKkUCkxm1bFOHv-kD9g01UlC1wJKc9E
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FmVBIoPSOr8gy%2BPFw13o2yPDevTBNkAyb5Rihh64DIXyz4wVqMg5AcFlABjkrcHUuQVCu8gYc5Zu2NExjhaAnyHi4zdrJaKiU52J7BtBknkx6YiOAuJfbdJ%2FjhmUzIFDrqWtBE0GX0JWsA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9439d6b08c5fdec3-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=61n2O%2FO%2FRRjGNqZT8tG2wZrxB4Xb3vCFCLwCAHc46oB1Jk7bN4avI0lAsjjSxDsqBD7P9snp7CjyILUtBB6d%2FCctNtNz0JHtXYQcXsXPvoI7o4%2Bl6EB9TtWB%2BZlPx2gmo9vGbORM0GiHmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9439d6afa961dec3-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 05:15:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame A554
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aC6zDNHM4Y4AFRrpAOc9rwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
795 B

103ms
103ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCnlAEQj8-UARjKtfW4AjAB&v=APEucNWrW8coPBANa-RcJNoG56h6hfK0QAcyj8LiYXPqQ7LZBo222TWRr0vG1SvsYFFrF0ECWcoFogPr8LT_lP7VeKkUCkxm1bFOHv-kD9g01UlC1wJKc9E
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6dFMxfM5LRyQ7YBW39OmHiaHIGf2md4zxoAo3BcXRq4yiYVDEA9GspUng25CnXV3ra4t6ZJ0lIuYcd7o1YCRSspLEGoS9mvPr5fdvkNE3PFTE7HHLXqPxVZK2uDCQRku52PUo0dIYHzTw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 05:15:57 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9439d6b22a07c213-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame A554 170 B
188 B 159ms
153ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CKCnlAEQj8-UARjKtfW4AjAB&v=APEucNWrW8coPBANa-RcJNoG56h6hfK0QAcyj8LiYXPqQ7LZBo222TWRr0vG1SvsYFFrF0ECWcoFogPr8LT_lP7VeKkUCkxm1bFOHv-kD9g01UlC1wJKc9E

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A554
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgzNTY2NjkxMDI2NzM5NDcwOA%3D%3D&gdpr=0

170 B
188 B

158ms
157ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgzNTY2NjkxMDI2NzM5NDcwOA%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTgzNTY2NjkxMDI2NzM5NDcwOA%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.246; 162.245.206.246; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: e922bbcf-e26b-46ba-b650-ac8dd89f354b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9E9C 38 KB
13 KB 137ms
134ms Document
text/html 2607:f8b0:4006:80e::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2024
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 04:42:12 GMT
expires: Thu, 22 May 2025 05:32:12 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 225ms
223ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

93e68aab7d308ba771f6b271c752d79f0241bc3f4b53c1c1fe71d249aa0e4895

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 05:15:56 GMT
content-type: application/json
vary: Origin

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame DAD2 0
170 B 301ms
149ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_push=AXcoOmQqk7beEkHTvzFXwzEG7wFxPW9sk6Fcp12iQHzngX43A2vxHFrVNUniP_toUtWN85rQbMf-62kBKJIj24TOWKof-2ceqoHREQ
Requested by: Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

via: 1.1 google
date: Thu, 22 May 2025 05:15:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAD2
Redirect Chain

https://tr-us.adsmoloco.com/pm?google_push=AXcoOmSExLshkNHJWKznK96yeTCeWtPCuNBcTjTBJ8LgvsXePWHIeE2UOzKlW0KoL4zb8DoK6w7L3msJVWjCHDWy8F0ZNpIPbS3yZA
https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=1I7rkamnQMCPs7Gx7Na01A&google_push=AXcoOmSExLshkNHJWKznK96yeTCeWtPCuNBcTjTBJ8LgvsXePWHIeE2UOzKlW0KoL4zb8DoK6w7L3msJVWjCHDWy8F0ZNpI...

170 B
188 B

154ms
153ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=1I7rkamnQMCPs7Gx7Na01A&google_push=AXcoOmSExLshkNHJWKznK96yeTCeWtPCuNBcTjTBJ8LgvsXePWHIeE2UOzKlW0KoL4zb8DoK6w7L3msJVWjCHDWy8F0ZNpIPbS3yZA

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=1I7rkamnQMCPs7Gx7Na01A&google_push=AXcoOmSExLshkNHJWKznK96yeTCeWtPCuNBcTjTBJ8LgvsXePWHIeE2UOzKlW0KoL4zb8DoK6w7L3msJVWjCHDWy8F0ZNpIPbS3yZA
content-length: 235
date: Thu, 22 May 2025 05:15:56 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAD2
Redirect Chain

https://rtb.openx.net/sync/dds?google_push=AXcoOmSjAHAdiNGN8oWAcooY7aqYfp6A9okqWqN72QX_m8ASQlJdeW6khfF4LOu5Hiqit46Vit7G_YjGcl5XEIaq7Q0oUNdM4Biulw
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSjAHAdiNGN8oWAcooY7aqYfp6A9okqWqN72QX_m8ASQlJdeW6khfF4LOu5Hiqit46Vit7G_YjGcl5XEIaq7Q0oUNdM4Biulw&google_hm=DBRWe7T_wDcz9JS2e1h_LA==

170 B
188 B

166ms
165ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSjAHAdiNGN8oWAcooY7aqYfp6A9okqWqN72QX_m8ASQlJdeW6khfF4LOu5Hiqit46Vit7G_YjGcl5XEIaq7Q0oUNdM4Biulw&google_hm=DBRWe7T_wDcz9JS2e1h_LA==

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: private, max-age=0, no-cache, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AXcoOmSjAHAdiNGN8oWAcooY7aqYfp6A9okqWqN72QX_m8ASQlJdeW6khfF4LOu5Hiqit46Vit7G_YjGcl5XEIaq7Q0oUNdM4Biulw&google_hm=DBRWe7T_wDcz9JS2e1h_LA==
pragma: no-cache
x-forwarded-for: 162.245.206.246
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 05:15:56 GMT
vary: Origin

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAD2
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_push=AXcoOmS66yjKhonKpjcG_w5Z1QomHaOaaSZuzTrTEHqrLB...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_push=AXcoOmS66yjKhonKpjcG_w5Z1QomHaOaaSZuzTrTEHqrLBKkap_4tdf...
https://cm.g.doubleclick.net/pixel?google_hm=aC6zDMAoIkgACXymAaGU5AAAB-cAAAAB&google_nid=index&google_push=AXcoOmS66yjKhonKpjcG_w5Z1QomHaOaaSZuzTrTEHqrLBKkap_4tdfSl0mLDvivOvPPgiIRBwNKA5-CtMu3AFdx2N...

170 B
188 B

151ms
151ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=aC6zDMAoIkgACXymAaGU5AAAB-cAAAAB&google_nid=index&google_push=AXcoOmS66yjKhonKpjcG_w5Z1QomHaOaaSZuzTrTEHqrLBKkap_4tdfSl0mLDvivOvPPgiIRBwNKA5-CtMu3AFdx2Nnz-jJ6MyJC

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_hm=aC6zDMAoIkgACXymAaGU5AAAB-cAAAAB&google_nid=index&google_push=AXcoOmS66yjKhonKpjcG_w5Z1QomHaOaaSZuzTrTEHqrLBKkap_4tdfSl0mLDvivOvPPgiIRBwNKA5-CtMu3AFdx2Nnz-jJ6MyJC
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L5oVqH8L%2FX9UhGD4fFYstehDCj5erFqcu0o2mlqgTRLONfQcT%2B8hYF7q933yhu178%2FNfCNWvOBg1Vw4N%2FjwdqDJVq3EQekb7ClMIRRxzafmwQEiWqLN8VinMOL9GFDRA3OQGcLlgZnPozg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9439d6b11994525d-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 05:15:57 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAD2
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQ0FFq7wh8ebFqn9fPVXi2MnnHRxUfhMxYOwcW7Js4gyxux8dLPFlO2-v1V48ONPGueNpsXXibcUQ7AR-6f4QUrlIyVrMhS
https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQ0FFq7wh8ebFqn9fPVXi2MnnHRxUfhMxYOwcW7Js4gyxux8dLPFlO2-v1V48ONPGueNpsXXibcUQ7AR-6f4QUrlIyVrMhS&tc=1
https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=fYU7rFtHfsObgke5hR3lCf6A5ZqAknGk_zYYhaBVQkM&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQ0FFq7wh8ebFqn9fPVXi2Mn...

170 B
188 B

215ms
214ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=fYU7rFtHfsObgke5hR3lCf6A5ZqAknGk_zYYhaBVQkM&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQ0FFq7wh8ebFqn9fPVXi2MnnHRxUfhMxYOwcW7Js4gyxux8dLPFlO2-v1V48ONPGueNpsXXibcUQ7AR-6f4QUrlIyVrMhS&tc=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=fYU7rFtHfsObgke5hR3lCf6A5ZqAknGk_zYYhaBVQkM&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQ0FFq7wh8ebFqn9fPVXi2MnnHRxUfhMxYOwcW7Js4gyxux8dLPFlO2-v1V48ONPGueNpsXXibcUQ7AR-6f4QUrlIyVrMhS&tc=1
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT, Thu, 22 May 2025 05:15:57 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2 204 google
gtrace.mediago.io/ju/cs/ Frame DAD2 0
293 B 439ms
136ms Image
text/html 35.208.249.213
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://gtrace.mediago.io/ju/cs/google?google_push=AXcoOmQFf7n5HS3FiIwwD5wEhohQ5YzH9sZZ_k5XGw-yZAFSUM9hLil-HKupaMDQqMDuwIF4jDGVurfiXq7qablG6sm6DqnQ37Gr1vc
Requested by: Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.208.249.213 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 213.249.208.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

access-control-allow-headers: Content-Type
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:57 GMT
content-type: text/html; charset=utf-8
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DAD2
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_push=AXcoOmR2Bq_J1ygGmaPdiiS93OrJSjpo4sJbKE8wqHQST_eMES4nZAfowGuyGyIJFJhNpFSl9w9lkd1NGyiOC9zdH1_nEPBLWa0WHjk
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR2Bq_J1ygGmaPdiiS93OrJSjpo4sJbKE8wqHQST_eMES4nZAfowGuyGyIJFJhNpFSl9w9lkd1NGyiOC9zdH1_nEPBLWa0WHjk&google_nid=whaleco_services_llc

170 B
188 B

151ms
151ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR2Bq_J1ygGmaPdiiS93OrJSjpo4sJbKE8wqHQST_eMES4nZAfowGuyGyIJFJhNpFSl9w9lkd1NGyiOC9zdH1_nEPBLWa0WHjk&google_nid=whaleco_services_llc

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1747890957017|4
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmR2Bq_J1ygGmaPdiiS93OrJSjpo4sJbKE8wqHQST_eMES4nZAfowGuyGyIJFJhNpFSl9w9lkd1NGyiOC9zdH1_nEPBLWa0WHjk&google_nid=whaleco_services_llc
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1747890957017-18739444424afe3bee24d63fba21a0b1-20
cip: 162.245.206.246
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DAD2 0
12 B 152ms
149ms Image
text/html 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KaoX2b3Lh6TsndjlsSMwQ2hI9mg99wL3GSmJKJt4BX5U1kx5r1LTL6VJAI8iwVkBypXAmod8M

Requested by

Host: ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com
URL: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/safeframe/1-0-44/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 169ms
167ms Fetch
text/plain 142.250.65.238
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55k1v9101576445za200&_p=1747890950232&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103136993~103136995~103200004~103233427~103252644~103252646~103301114~103301116&cid=61799409.1747890952&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1747890951&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fsdgwsq.dirtchicvt.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=38&tfd=7184
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.65.238 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s73-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 05:15:56 GMT
content-type: text/plain
server: Golfe2

GET
DATA 200
OK truncated
/ Frame 8469 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5bca0834b8dec808202ec436c8d7ecc0391f248c127366d70140f618b1717a27

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame F954
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=2400635328553490228

0
392 B

120ms
119ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=2400635328553490228
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=37ff7810-8b25-4f71-88f5-2ed15f88c14e&neustar.biz=E1:4L2kjrJFyu5ElrWawktPV2tLEknmUq05J213SSeabw-U9EEzbwmT3Tch8XK1W8vxZ6Ter5MGq9cxW7Rin_88ywNuAMZ_uHk6ysIDGuqgH5XSoM7wc63HMIcZLpz5UhoO&33across.com=v1.0014000001YrMoYAAV.1042.3ZqIYCav4FG2IBEi09HXdOQWWX817Ohz5BWsMLYY7rgX0xuhp8xjPClQ7xuouT/Tohmq772JA4z969BI/r2DRE7qmgMneu7nJsdAL7+ccdEkJIyGx0gjff0bA9p2s7kDtw2+rdOqpowFRvTUrxVy5m+8eX0w4YC6ySs39GB46WzNzbm3sY7Wuzbe8HaPt0M3HL+nCvcbUfgeccC2ukWZNG6Aee3J4sxbosS9MqYSZl1NvJTOffFm8gGElTJoXIK0ZG2ZDVCuHT+tEDUayWB4Re26OpXmV9PHfRkwKVyKRZOAubaFO98s18pjXH4f8BDNi8TTMjmGRUuogZYt6GKPNBZl5ExQ6gNclkq9MP+vE5nSI73piC0Wa4ZNbqJqH0Q2rVk3i3KYrpkednY7TAGuM03/K9GuEVMVhZtoS25Lw9+Z64XJUZ8SsnN6G1ENTfHEJ4brpOUh7xtfgaNO55WcLfpEHztrvgN875ffs2mRDIc1sHd1RFTKMfjRkakXyBwbRAzic1XCnmLeVhCc8K+BZxBx1I1Q+VlcK3ghKeYsk0iYGmCT0aaIa1gPJEzGbUL105TlZqKe287HNoCkKKvIsf3ulzjFZbmrpg1QPrtUfZENMqobcvYaWK5rPFa/j7kohjw+sE6Qg7OlUoI+bxTMpiqibzYJRvlOhJo+ytlcfMgNaOSkUo8AR/DLwg8pHi0lptrPrEjulPNDcIp3dHMMnC9RZLBvTWTrkNGLgGXaNk+E+o7jRvZ3FvU3ehXEtcv2QEJ9C68WzF2lgY7ilrzhHWJSXUWerU82pE8xVy49lhqFZya9G+sS0i6YLVcEG2yxjmro9RuqAZbyoX2rNDIfWH3/9k99U0b3ZYxhsE8K/QsXK97XFAve+sbkETpofjBpVP+NR5JmxpvIgDfEcn1bvTmENX33wCgbRYlBnHP10J5r+qDbh7tmiLZkfxqR+I3yFqAZzbhkfCAW7E3oQyT5LxuyRKoQhsOgq7COv/sPv0dc4p1QuEsRjUBDQBj3RLBMIcyDT8ylJDS1ZM/y845k6m6+YwnRYjc7QwoL+6xV+lC6gkvySik8edswoHMeaCSyv2H+ce8Sb1l32tDnP6P/vnBQZ/MLyBHqSmNQc6ideOfZK41IE99dQdegPY2OfOLolLsQEOaBZT+KCKlTI0EmO1yaV2OypvNFnwubr/Xvk+dG8mXOfxvSrkmCs3yFCyX/4ubWqjGP6xWdDGN/dXTA+MiVFNqhvJ9hfKY+S3Sb+IDa18noGIrAp1R1oC8Zutd4WE6MlmfI1amxnMuMhRIb9h+KrYnejwyPir9wHzmRjjh3n+TPe9f8xnQ1uFPuDutIvXUmgwo6YDtBiIC3n22ha0Zzrr2Vt4ROLJFnwR11/E5YsF3/ey8/Dw30zdw7bdCk7IekCJKhkYLXh7GTy+mrjNS+ixwWRdyEv5FTlGrLVShSYlJrmgIsqztpA80cmCYqOOf4LhfGyj21pw41EcjAKnMAC8O5SUS/NBRbyajcjqqxfWAhvvZK3xeIaogfBzTs&liveintent.com=15-F7e6O3qX79ylnoU6aUE3vodevYLrpqsFm9G6o5H8zyRbiDXFa9MBx8xF0YDWW3moUHpaaUVgZDRXtxR6PvCijpIfjlB0P7fPi1dpY22/Ai/JUw==&bidswitch.net=f726dd3f-acd0-4ebb-a862-e242e14043d8&linkedin.com=dc4aeafb-5d47-469f-acab-569895dc096e&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747890953808&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 9439d6b4eb227eb4-LAX
expires: 0
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=2400635328553490228
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8469 0
0 156ms
155ms Fetch
image/gif 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8469 0
0 152ms
151ms Fetch
image/gif 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8469 0
0 148ms
148ms Fetch
image/gif 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame FD46
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
379 B

141ms
140ms

Document
text/html

23.47.170.102
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.47.170.102 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-170-102.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 05:15:57 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 05:15:56 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 8469 624 B
720 B 327ms
140ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=1&ttmms=21&ttfrms=26&brid=96&bridua=3&bds=1&tstype=128&prndr=1&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTau67efgddgg_f___f6%602h5ef22h3%60ba7cd%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=105&ddur=636&uid=1747890956923312&jsCallback=dvCallback_1747890956923961&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7821&tgjsver=7821&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2Fef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-44%2Fhtml%2Fcontainer.html&fcifrms=24&brh=2&dvp_epl=205&noc=16&nav_pltfrm=Linux%20x86_64&ctx=16835890&cmp=33442634&sid=4553089&plc=420979050&crt=234583643&adsrv=1&advid=4834926&unit=160x600&c1=Insert_SeatID_Here&prr=1&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0hQQZ0reBvZtRuqFXwpN_3T&aucmp=20331529123&aucrtv=656235210&auorder=1013305811&ausite=1995081996404&auxch=1&pltfrm=1&aufilter1=Insert_SeatID_Here&autt=1&mib=0&mon=1&blk=0&dvp_cawf=crtwrp&cm360cw=1&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=274267231.45271534&ee_dp_sukv=274267231.45271534&dvp_tukv=835191613.3967105&ee_dp_tukv=835191613.3967105&dvp_strhd=0.3999977111816406&dvpx_strhd=0.3999977111816406&dvp_tuid=461290991956&jurtd=2549335459
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 7729d6f85a71ad9ba36d13a9e1583fdc0ec0f4803718060c5f4d5e593b923a38

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 05/21/2025 05:15:57
Date: Thu, 22 May 2025 05:15:57 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 1B2E 2 KB
2 KB 134ms
133ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=75511133&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: b56ae082af690e9a4bb68ad9d7940fba1b4ab83c93757331ceeee52575c48b0f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1834
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 05:15:57 GMT
content-type: text/html; charset=UTF-8

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame D585 0
797 B 147ms
146ms Script
text/html 68.67.179.87
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.246; 162.245.206.246; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 828c5129-e901-49db-ad23-29aee4ceff78
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 8469 0
0 157ms
156ms Fetch
image/png 142.251.40.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjssy1lCJ8GoqycpF8uSX9-gFxRqDuU9RzR_h3kFQTN5C_k3_pJIYzeljvte-wmUr_o9mGm1-xqlRfwROiZWtTFbtvyq5N8jFTPBxislIMOdCa2q9YlxUwlqsVEJYUjqCeu0n6WSJtS1DePQD_08jyku71ByGEgyKhFa-Vh3Pw7gkOuKJrCGM7cj5-S8VbDXTBtY6SwvdU5MLpxOzlEU5drIFsPQH8tNqLJfDMtKAa9uRJNyHiIuwxng4jIs467aPont8_Lm5ubHPZkTu6xiyqhkQDg1broCqEJ4XduL7-bOfVJzRuupRqw6b-dCGnq6aIivfxFqpRagyGuXFcy4XExangfpp-WfXCGOUL7PbLboqPB_VUUg-O53r0u4T7RFwHpuKCyevOQfhsSU-9rkHjpVch-bsDqGcpWZwRX1Zm54QG3WsSOalPH1YFF7WkeCpBXu52C_J6rj0vIMv4OrsXGjXPrAtG474-PKbXMERvEFQYzr82w8SIJ8MqKAHLhjpgu-Wcb_fQ-W_3d-zdaKDlr7H-vv2fRsHe34OK2wlUXAnmzJmP0eaT6Dn-UNu2hao_GKLQAL1TsTc5hiFFwQ60aQ-i8gLOj3s721oCZkNcZOzTDsDyn13E_YpNMiv_pmXH4cQASdZZTrec75wVy7iP8lkxW9W0M5eGkB5MncgUEPOgVW5sxXG7qHus2QEebiKI3rjwX1YceiSZMue60f7XFlxBAqV6HijzCj8w6eMlVRqL6bsWEznVgptYrZ-26scK0QeJVaWVMyF5B58jOC8z78CxAUagZnNoGi8gTX6OY28aF7lpnwjJw8w-5K5NBXNQZBjXFseZ664M52km4YjvwHleaW7TrvenZRlzqasA0cf5cnMWE_FWBbFndYUQcWDQ-zD_3UOlUAi-j2t88v33PgjRRjtasE5n8cEyElbZUirS6J6Fz6G3vQId4KbXnJmyDVhEzts7ifWIP8A-K3uOeKwud9xUxR5dT5k2WXnjyNEzuYitQaHYXfjyzBf2B9G8filsIUQ3Q1bw-l2yo3NThQHwaObTXZLxKhcixUqZrj5w84C4CTM-HQXIQ8fCuNTmk4YMHROR4-4vlD7ropc8p07PAyN3oQJ2JXk1oQ-qPPWwNo5mWZsTwwFHGUDxbZER2TdFIR46Rquwh3mcBHyCHH2PUtpd0-j9KViP3yiTft8VQ3tEgQKh_Bn1vaSFOQzZWvmR-60CH3IL-AzJtD071cRP7iFjTy0H4XKjrNfMAKL-RTrReHkJKKMXLoEKHiQb18oMak5qgKmcHnrtAdLuMjFhLS-dGukmiticMY4mZNSVObP2wB2vSFIKa91ZJE2JKiLWIsZLYRHWt2oNHeh52Ao7vbryzJxyQgMsrMamcuDV8R1CK4fszzY3yRuG9dOu4ogcvXdjIk99vh2bGc7KHSvD7O9RicZ6WopRWd7CuKorbV-RWbVARtONCBMvSk6Mb3yzkaheTZp7asyn-GWBRQgey5-WFUOBVSSmPhtW2FqMMRcwLsWzEJBm5RKvBT3kSZfh-lNEI5462zreX11riL_QfMjKdUT6Q-CpG447ZADeey-zI-VpFrOqPsZBiQtKssLf20TIXQnyjJy_6noxCscRvBwbZfZq6hSvKZ3hhzp_pwOuRtR2rDY9EQQA42fFCgOfaCg4gMevJYw-bdzYfX0HjAK68R625nqOlXsZpxnKKLyajkmvt4974EGI7bjT0bGOEN-w6CpUJPhgYpJACysh9J5LzAoG_1HAIu5zCcJxOvCQtv0hcmq0_tNZks5W_jTWEggrridH7JsEIk6wK4b8iZHqPQBL-3nAjYGw0NmvNmTw-tfGAV5uHUnxFSlfr9ie1feqUM88Q&sai=AMfl-YRqE53wxZxN7ObGvB16lD1LvLxIqtm8B-is5HgC2mLTxagjK7RysGJLSKhgzzXwkQYQOOVF-Pk7fFPSJX9J43UdkJ8QdO8AOEtZOe2trqK7rv1f9sJxTJeQ_Kr6X14MGrCQI5NHClDpjiF6BGrLFYGUadE7hKlrkb9wh22AIdXtvKnJtJJz5XRM-yeT0YZCOd1eJPjRjAq7zgN82MFwpPAUY7RemAsMkHXjBsLrQXzz3wF396Z28gki8tHNICOwerN0CzEAgwSdYAQDLDkLEogAnVeSIDRJUDHf5GUoHnBwYA7yl8P7dVT469QL5eIFeaKPWOH43OBuBGawYZKTRptRgq4ac_TPEAdlqOMbZne6ZQPh5CrTU7UQNhqjxqp34QqpK3OrAxox_ARDGHbVB3-bjX2sgPU4286tddsfbng0sz7xoEU&sig=Cg0ArKJSzANvp0n87Qw_EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9uaWtlLmNvbQ&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=981&vt=11&dtpt=979&dett=2&cstd=0&cisv=r20250520.81504&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.198 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s38-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ef6785588070007e1a9d67aa9b132f45.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 22 May 2025 05:15:57 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 22 May 2025 05:15:57 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"908705256":"0xa1c998f4727b27530000000000000000","908705257":"0x60396e398f4d01120000000000000000","908705258":"0xa50fcf9a7e6ffcf70000000000000000"},"debug_key":"15308027667573019598","debug_reporting":true,"destination":["https://nike.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["1350256"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["4171764"]},"max_event_level_reports":2,"priority":"0","source_event_id":"2961007394046639447"}
server: cafe

GET
H3 200 Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js Show response
pagead2.googlesyndication.com/bg/ Frame 9E9C 54 KB
21 KB 135ms
135ms Script
text/javascript 142.250.81.226
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.226 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS