paint.toys
3.33.186.135 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 19559
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 23:52:05 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JVX6JH9SDPADP37M4XY7T29N

Redirect headers

accept-ranges: bytes
age: 3557
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1662
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 23:52:05 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JVX6JH538D7KYF69NDGBME2T

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 290ms
142ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c841b20d470f73aa637acece9fbd1b8f946f150cc414abdefa5bbf6a23e35fc4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 944039a9de740ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:05 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 77ms
72ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 26707
accept-ranges: bytes
content-length: 1373
x-nf-request-id: 01JVX6JHD2T21R7Z8J2QFF8BAR
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 76ms
71ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 12361
accept-ranges: bytes
content-length: 1204
x-nf-request-id: 01JVX6JHD2C2V98MF7DRE80NAT
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 362ms
358ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 20252
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JVX6JHD21AZZVRQP50W8H4T0
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 81ms
77ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 11117
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JVX6JHD2CC17R4QA3329DVNA
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 344ms
340ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 11117
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JVX6JHFHMZ1K5B6CBTZNMWK9
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 353ms
350ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 6280
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JVX6JHFHPQR3JR8QNYDA7K7M
cache-status: "Netlify Edge"; hit
date: Thu, 22 May 2025 23:52:05 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 167ms
102ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b28112518cb0a0fa0d3afaaccc89e2082517877764b2b5be68b34b28ebd6d12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 944039a9de780ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:05 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 370 KB
125 KB 396ms
145ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4bb80890e98ee6a253fd4af3035ffa9ed522c6563b86c87453747438ad0590e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 23:52:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 127278
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 j406wv9b45h_3.v2.js Show response
faucetfoot.com/assets/js/ 68 KB
25 KB 368ms
199ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

059f93b1013945924558621fa779ebacfd92570b17ee5ff820858168dc6fb9a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-spot-jb3g.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
33 KB 512ms
144ms Script
text/javascript 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7767183a94303d980e628cd3c4405e172e71578584fdbee73595489d00f888e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 320 / 20230 / m202505190101 / config-hash: 16338732288058072325
x-content-type-options: nosniff
expires: Thu, 22 May 2025 23:52:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34236
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 107ms
101ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 413
cf-ray: 944039ad6a220ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 411 B
387 B 88ms
82ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cefb14adf44d7be710ac086bd9956380a96dc8220bcca80af1144e3c5312877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"d8cc960b7ac2417b4c245b40d1501e32"
age: 1505
cf-ray: 944039ad6a230ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
411 B 162ms
88ms Script
application/javascript 104.18.25.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.25.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce0e4532e47a25e8cd13e7281a7c9eeeab4525be19a5bfb5a7804fbdbf3a6f0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 944039adda757eb4-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 22 May 2025 23:52:06 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.688a9519bf222c577628.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 101ms
99ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adb9d1101e62377f34b6db7996ffc4eb80f8968ae7063b988ba2d85ee2ec2a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2014aef5a932767aee99c8c09ee9aea2"
age: 1513
cf-ray: 944039adeb120ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.de88eb0a31bf4b182063.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 519 KB
157 KB 114ms
113ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6395a8c7b596927e52b00afe7511a91cf9043ae95d61763316ab139974b1bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"81a507d88d3b44587deef78119119de8"
age: 1513
cf-ray: 944039adeb190ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
111 KB 141ms
139ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55l1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5f2f52bdd2ce7fb3324a8b79ebeae739a08200245adfba1e37aad4621b63031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 23:52:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 113305
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 855ms
144ms Fetch
text/plain 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55l1v9101576445za200&_p=1747957925255&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635&cid=2071317095.1747957926&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747957926&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.videounlimit.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1680
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
480 B 411ms
120ms Image
image/gif 2600:9000:28a9:c000:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_7435261
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:c000:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 13647
x-cache: Hit from cloudfront
x-amz-cf-id: 9eXW8GTRZqR6SXlR56Cla6fAYEy_6h_zayGE2tqatCSMZL5st2lUzw==
date: Thu, 22 May 2025 20:04:40 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5411e516ed0ae08b04f45ecec0d0c81e.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 911ms
659ms Fetch
text/plain 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55l1v9102396898za200zb9101576445&_p=1747957925255&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635&ptag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635&cid=2071317095.1747957926&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1747957926&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.videounlimit.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1747957925255&tfd=2232
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55l1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 131ms
130ms Image
text/html 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-CEFZJ359V8&v=3&t=t&pid=519180954&cv=1&rv=55l1&tc=7&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635&es=1&e=gtm.init&eid=2&u=AAAAAAAAAAAAAAAgAAAAAABA&h=Ag&tr=1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ccdgaregscope.1ccdconversionmarking.1ccdgalast&ti=2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ccdgaregscope.2ccdconversionmarking.2ccdgalast&z=0

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

report-to: {"group":"ascgcycc:891:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:891:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:891:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:891:0
content-length: 0
date: Thu, 22 May 2025 23:52:06 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 133ms
132ms Image
text/html 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

report-to: {"group":"ascgcycc:891:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:891:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:891:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:891:0
content-length: 0
date: Thu, 22 May 2025 23:52:06 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 134ms
133ms Image
text/html 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

report-to: {"group":"ascgcycc:891:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:891:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:891:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:891:0
content-length: 0
date: Thu, 22 May 2025 23:52:06 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 139ms
138ms Image
text/html 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

report-to: {"group":"ascgcycc:891:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:891:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:891:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:891:0
content-length: 0
date: Thu, 22 May 2025 23:52:06 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H3 200 a
www.googletagmanager.com/ 0
14 B 141ms
140ms Image
text/html 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

report-to: {"group":"ascgcycc:891:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:891:0"}],}
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:891:0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:891:0
content-length: 0
date: Thu, 22 May 2025 23:52:06 GMT
x-xss-protection: 0
content-type: text/html
server: Google Tag Manager

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 559 B
444 B 77ms
77ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 1503
cf-ray: 944039b318560ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 0B79 503 B
428 B 374ms
180ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 1514
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 944039b4599dcb83-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 23:52:07 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame D8CF 503 B
0 362ms
362ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 1514
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 944039b4599dcb83-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 23:52:07 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/19/desktop/Chrome/ 585 B
920 B 1013ms
742ms XHR
application/json 2600:9000:215f:3200:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/19/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:3200:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 74b1e9cdb56dd8a99f4d35fb2204a58e8182887b208e323b91e3a15b687fe9b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3061
via: 1.1 b6989f0f2e150081d90f4c11e6692d3e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: NbsWKFzS6X0xpnPFAgi_cIcq74-L3BKv_Acv9f8WsHRs4gxUC3_ipQ==
date: Thu, 22 May 2025 23:01:06 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 230ms
91ms Script
application/javascript 2606:4700:10::6816:4bd8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4bd8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a13958b28ca0d85823b3bd428bc3222ad867118b1ab1fc1082520420bf6e7b3b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "96567f228c363f8b97d8224dc3fbfdd7"
via: 1.1 google
cf-ray: 944039b43bbfdb7e-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39547
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/javascript
last-modified: Thu, 22 May 2025 23:05:45 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 72ms
71ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 1503
cf-ray: 944039b368a00ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:06 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 546ms
282ms Script
application/javascript 3.171.53.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.53.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-53-95.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 2082
via: 1.1 074df32306fddeb7d54ca41312e6888e.cloudfront.net (CloudFront), 1.1 7d89d82082cffe438c41bd536e706dfc.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: DGeeIypL9o-bIsjY5Tp6KnTuMZztHRLpbbV7Ql_57Vxfljd6H8DuwQ==
date: Thu, 22 May 2025 23:17:26 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-P2, IAD61-P8
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
587 B 682ms
221ms Image
image/gif 2606:50c0:8001::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: e3118011cc4ff061d8e47712ea1ab55ea2e4c902
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 9505:14FA39:997900:B00289:681072E4
expires: Thu, 22 May 2025 23:57:07 GMT
x-cache: HIT
date: Thu, 22 May 2025 23:52:07 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350042-TOJ
x-cache-hits: 1
source-age: 20
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1747957927.482884,VS0,VE1
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/ 537 KB
169 KB 123ms
123ms Script
text/javascript 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecb14ba6e443cea8cf2f668d600a627bbf7af37cce884a57cc57082356087aa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12745184525860094308
age: 5206
x-content-type-options: nosniff
expires: Fri, 22 May 2026 22:25:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 22:25:21 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173193
x-xss-protection: 0
server: cafe

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 634ms
131ms Script
text/javascript 3.167.69.51
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-51.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 18721
via: 1.1 c8e5a51ce52caf510dff11d206de43ac.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: PjSVlftw1Cjg9PzGKMn8X8dgU-bfjYS25s7bz-ZAoKcaNQRUGFAZVQ==
date: Thu, 22 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505220101/ 63 KB
23 KB 528ms
527ms Other
text/plain 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505220101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

8c9c942cbc4b50a998e5204686305e5192f73e9a64425654ef4b8716015b8b67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10260624382802495031
age: 5206
x-content-type-options: nosniff
expires: Thu, 29 May 2025 22:25:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 22:25:21 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23619
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505220101"

POST
H3 200 ab93v0d2abbu0f7xc3 Show response
faucetfoot.com/0/h1vuruh/ 295 B
319 B 187ms
115ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/0/h1vuruh/ab93v0d2abbu0f7xc3

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/js/j406wv9b45h_3.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

1eb8674b85d5896025deb9aca017d4f4be10c76332061f0468c3993b6b044204

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-spot-079b.gce-us-west1, 1.1 google
expires: Thu, 22 May 2025 23:52:06 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 0B79 17 KB
7 KB 94ms
94ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1513
cf-ray: 944039b5ff66cb83-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame D8CF 17 KB
0 95ms
95ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1513
cf-ray: 944039b5ff66cb83-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET 96be6cab-ff04-4160-a9bd-46dca89310dd
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 368ms
124ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 23:52:07 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 227203
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 159ms
80ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 70452
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Thu, 22 May 2025 04:17:55 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 944039b77f69cb8e-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
1 KB 83ms
83ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 1510
cf-ray: 944039b70c730ff8-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:27 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 392ms
132ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: swxqz.videounlimit.com
URL: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a6346967bb656fca621852a56ad2317853110ee58daed87b5f13914f1f0346c4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 417ms
159ms Script
text/javascript 2607:f8b0:4004:c17::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec54819df0af82b3ec2255595821288f2c2eaa9c8c3c779b1d025e2728efaa05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 17583717982418206928
x-content-type-options: nosniff
expires: Thu, 22 May 2025 23:52:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145155
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 659ms
225ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-4-88-156.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
779 B 381ms
130ms Fetch
application/json 34.239.219.126
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.219.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-219-126.compute-1.amazonaws.com
Software: /
Resource Hash: 12662c125764272a3c62fa2d599b0775a4600218409b162049a1035e512e831d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
682 B 415ms
129ms Fetch
application/javascript 52.200.238.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.238.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-238-32.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 1f12b6b6f6a4fde19e82bb007099af355960fdd81b9510c23fe1163bc6fe12b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 299ms
161ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: b39a793967e421c0ecb27f21c083c432b254e511338d0bcc2b868d086b5bce65

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 482 B
895 B 448ms
146ms Fetch
text/plain 52.4.88.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.4.88.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

498c358a4a00ccf797c69eb746174cec8c96fb2c0b8c7f14c06243befff06390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 6416baa79ffc94b8
request-time: 10
access-control-allow-credentials: true
expires: Fri, 23 May 2025 23:52:07 GMT
access-control-allow-origin: https://paint.toys
content-length: 482
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=W_REcnxoUmgvQU40b0VyWnJBcnkwVjNtL3Frd2JXNHVPUzZ1M0FTVmNKTitIZE8yODVlNHpwcWtRQU5rZjJUdnB5RnRqQ2FiK3lZZjZWQytIaUVqbzViUHdiTXFiVUdSaWJOTG1uNmZmeXhGemVUWWRVRk5MSFgveWNsMG...

362 B
932 B

363ms
123ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=W_REcnxoUmgvQU40b0VyWnJBcnkwVjNtL3Frd2JXNHVPUzZ1M0FTVmNKTitIZE8yODVlNHpwcWtRQU5rZjJUdnB5RnRqQ2FiK3lZZjZWQytIaUVqbzViUHdiTXFiVUdSaWJOTG1uNmZmeXhGemVUWWRVRk5MSFgveWNsMGlvek53UGFzU0h0OTFseDlNNStIZkYyd1lpV3U5UUpHSVRTMDF4bUc4R0Fud0pYS0hVYTNIWmxSWkhhZWI2Qjcwa2V1NksrZzhBQnM3WjNlRnJIUTZIOUE1VHBzazZrTUpLQVpEbnAyY3ZjancrWmV4Z2loeEJrVTltWWJPc2xBWXNvNGJDc2w1fA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

99dc24c59a40619e4ab48402a376c5bb654e452058a8d76ea0b467d0f2123db8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 403536
expires: 0
access-control-allow-origin: null
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=W_REcnxoUmgvQU40b0VyWnJBcnkwVjNtL3Frd2JXNHVPUzZ1M0FTVmNKTitIZE8yODVlNHpwcWtRQU5rZjJUdnB5RnRqQ2FiK3lZZjZWQytIaUVqbzViUHdiTXFiVUdSaWJOTG1uNmZmeXhGemVUWWRVRk5MSFgveWNsMGlvek53UGFzU0h0OTFseDlNNStIZkYyd1lpV3U5UUpHSVRTMDF4bUc4R0Fud0pYS0hVYTNIWmxSWkhhZWI2Qjcwa2V1NksrZzhBQnM3WjNlRnJIUTZIOUE1VHBzazZrTUpLQVpEbnAyY3ZjancrWmV4Z2loeEJrVTltWWJPc2xBWXNvNGJDc2w1fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 245617
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 23:52:07 GMT
server: Kestrel

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 594ms
123ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
628 B 218ms
72ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 21802
x-goog-stored-content-encoding: identity
expires: Thu, 22 May 2025 18:04:57 GMT
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 23:52:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2VwoF6WO_ukFE5UEXt_HISEmUJgFX-0ICA0M-_7XTn6S_2_lBcZTMNdm2YxBAxB_tktOlI-m_vX4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 944039b84a4e2b87-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 255ms
123ms Image
image/x-icon 142.251.167.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 8990
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 23 May 2025 21:22:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 21:22:17 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 218ms
73ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.02901348167247153
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 21802
x-goog-stored-content-encoding: identity
expires: Thu, 22 May 2025 18:04:57 GMT
x-goog-stored-content-length: 43
date: Thu, 22 May 2025 23:52:07 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2VwoF6WO_ukFE5UEXt_HISEmUJgFX-0ICA0M-_7XTn6S_2_lBcZTMNdm2YxBAxB_tktOlI-m_vX4
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 944039b84a522b87-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2

200

sync
pippio.com/api/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_287fbddd-c413-46a4-b5d9-cc0ee8a67028_1747957927435
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMjg3ZmJkZGQtYzQxMy00NmE0LWI1ZDktY2MwZWU4YTY3MDI4XzE3NDc5NTc5Mjc0MzUQABoNCKfxvsEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&_=2

42 B
570 B

255ms
124ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?pid=5324&_=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 107.178.254.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 22 May 2025 23:52:08 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, no-store
timing-allow-origin: *
location: https://pippio.com/api/sync?pid=5324&_=2
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 0
date: Thu, 22 May 2025 23:52:07 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_287fbddd-c413-46a4-b5d9-cc0ee8a67028_1747957927435
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_287fbddd-c413-46a4-b5d9-cc0ee8a67028_1747957927435

1 KB
2 KB

173ms
172ms

Script
application/javascript

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_287fbddd-c413-46a4-b5d9-cc0ee8a67028_1747957927435
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: 64f2185e64a99449ca33467b6ac4b4a7d80805e91c6a32400ba030547dd06bee

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:08 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_287fbddd-c413-46a4-b5d9-cc0ee8a67028_1747957927435
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:08 GMT

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 426ms
170ms Script
application/javascript 2607:f8b0:4004:c19::66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4f8017343555b3568a9f7a0baeddf48500fb6da09a54a3cc72fccbb913828251

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-B6BsqA-yVsGQu5X057zF0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw0JBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIm2PFx30H2QRmLNoppKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRqYGpkoGdgEF9gAAC75kKi"
content-security-policy: script-src 'report-sample' 'nonce-B6BsqA-yVsGQu5X057zF0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 416ms
169ms XHR
application/javascript 3.171.53.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.53.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-53-95.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-allow-methods: GET
x-cache: Miss from cloudfront
x-amz-cf-id: w2pbeLWSIdhzupDv9tsNd3sUvnh6-1a1niTpcthmixSQmMsSN7CVBA==
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 3edd8fb850751b7960b885bb82f786b0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD61-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 812ms
543ms Script
application/javascript 54.192.51.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-124.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1485
via: 1.1 fdced9a893123e4285bf6f674dce492c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: Xc57Wz9U1WHZMisgKomyAkI-A0cdmx_L5D36WCx8gMqI-J_1YIpTTA==
date: Thu, 22 May 2025 23:27:23 GMT
content-type: application/javascript
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 124ms
124ms XHR
application/json 3.171.53.95
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.53.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-53-95.iad61.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 20977
access-control-allow-credentials: true
via: 1.1 7d89d82082cffe438c41bd536e706dfc.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: k94QT43Hh9WfyV1rq86AtqiOpynbh1pz1fOXkvV6HXQ1yheVSrsJWA==
date: Thu, 22 May 2025 18:02:29 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD61-P8
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
375 B 550ms
307ms Fetch
application/json 18.160.47.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fswxqz.videounlimit.com%2F&pid=HnJwsCs9PPaV1&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=b5661f9f-df10-4726-a46b-a11a85023320&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.47.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-47-72.iad55.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 c378d79f6d61c9af35c366d426990acc.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: p4u5HmLdNtFlG-ehM6XjgrXzoxHN07s0S-zfk6q_e-KFgBOwa3x9Kw==
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD55-P2
server: Server

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 144ms
139ms XHR
application/json 34.239.219.126
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.239.219.126 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-239-219-126.compute-1.amazonaws.com
Software: /
Resource Hash: a32666fa5ccdb14c283bddf8fd74844e983549c7c7519e2012947b925a50b6e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame D2E9 1 KB
2 KB 202ms
61ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 709
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:40:19 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwqcQHVH-wjTVTfiHGvVl1jQn3JsvAfmLujbkOHa5d4bMuLcHAPd1CvPaZIJCMk9Yxlh

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame EF4D 2 KB
1 KB 528ms
268ms Document
text/html 23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=23556
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 22 May 2025 23:52:08 GMT
expires: Fri, 23 May 2025 06:24:44 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 253ms
179ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e2fc5e37c1d39341b0684da0f6f7bb2b73ff46f93f2571cf17512b5bb87e7e8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957928&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=60cxlMYlPkuU%2FRJckqCh7CVIpTdRilEwxiEtm4dX48Y%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957928&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=60cxlMYlPkuU%2FRJckqCh7CVIpTdRilEwxiEtm4dX48Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 944039ba0fc908f7-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 422 B
1 KB 369ms
297ms Fetch
application/json 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9cfb385783f25075b4abe4388805540ca87a97c007c2d08d245683c5ead4114

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957928&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=60cxlMYlPkuU%2FRJckqCh7CVIpTdRilEwxiEtm4dX48Y%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957928&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=60cxlMYlPkuU%2FRJckqCh7CVIpTdRilEwxiEtm4dX48Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 944039ba0fcb08f7-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 406ms
139ms Fetch
application/json 52.204.236.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747957927908&to=600&aun=pw-160x600_atf&pubcid=ebbd919a-032f-487b-80d9-c597be53c105&33acrossId=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=0001dbe4-1cb1-4839-928e-bbe9fb4fd245&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6451&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.236.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-236-171.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 1198ms
932ms Fetch
application/json 52.204.236.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747957927909&to=600&aun=pw-160x600_btf&pubcid=ebbd919a-032f-487b-80d9-c597be53c105&33acrossId=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=8a793455-3d2b-4a59-9cf5-2927e7e11aa0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6451&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.236.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-236-171.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 404ms
138ms Fetch
application/json 52.204.236.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747957927909&to=600&aun=leaderboard_atf&pubcid=ebbd919a-032f-487b-80d9-c597be53c105&33acrossId=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=5a20955e-f56a-4ced-83a2-dfde13c91489&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6451&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.236.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-236-171.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 406ms
141ms Fetch
application/json 52.204.236.171
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1747957927909&to=600&aun=leaderboard_btf&pubcid=ebbd919a-032f-487b-80d9-c597be53c105&33acrossId=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=afea056b-de53-4e59-990b-2b59e4d5e95e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=6451&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.204.236.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-236-171.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 657ms
381ms Fetch
application/json 34.192.42.219
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.192.42.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-192-42-219.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 691 B
1 KB 577ms
310ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=fa54e3f1-d59f-4196-86d2-be796777c4e6&l_pb_bid_id=73ec7f88a5ba8688&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=0001dbe4-1cb1-4839-928e-bbe9fb4fd245&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.07974727110101887
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c8f7edb23c04615fbb97c9dd68c6a3f1d4bc4cf499c07f7704a09891d4396abc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 523 B
883 B 578ms
313ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=fa54e3f1-d59f-4196-86d2-be796777c4e6&l_pb_bid_id=74673c83c8a6cda8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=8a793455-3d2b-4a59-9cf5-2927e7e11aa0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.8866901166588893
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 94ea50cbb339848732dcb50495bb8810bdabdb37dd933df9a7038d3e3acd00c1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 523
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
888 B 577ms
313ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=fa54e3f1-d59f-4196-86d2-be796777c4e6&l_pb_bid_id=75bb1f0e60b88168&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=5a20955e-f56a-4ced-83a2-dfde13c91489&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.04784762611149174
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 08136dd40461a878e8fcfdeb0187e15601468b545a38680baa2cb4056f034532

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 574ms
312ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.xI8%2B869tPnrYC6fcfheTCNrTKs%2Bt50jy%2Bqf3z0PXWh65Lw5IHMn%2BrSx4u7WVfiVquSNgXCDlrKNV%2BQZFmqX3ZorQ0jK6ZuxSBz0Yr%2F3T85ycJ%2BpW72qkZltXO5I5tMJci6lfR5peJz%2FK3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW%2BEkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn%2Fhx6f97Og8f%2FVRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8%2BmvO6hc6E5%2FKxV84TiB4u8EjimCNKws45PayxshnYXHyX%2BYP2Tr1J2jsjFihPEg2EC%2Fxy%2FcAStNrT7iREItV606zjFRsQtY4tg%2BxFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6%2FaWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC%2FDagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF%2BUNnPNFHoph%2FuMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P%2FiQNlh36CDE47MbuhoL%2FXXGEH7nX%2FRtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd%2FCuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX%2F5aSJWeWBJ7YJkSw8jW%2FoaHghFXi9g%2BXLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU%2FCJI%2BwASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c%2F5l%2F%2FqK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup%2BOnhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2%2BXZ0L7P0Fe%2FM%2BVdph%2B0c1KI0Rn7rBX6q9zexP703%2B43cJNWwGZzG49OSS24E0C2O0%2FjWL%2FmE0Qxnrcjj0V6kE0UeI%2BJU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD%2FbU%2FgxPcZ%2FvW5FPJHrTQT0zTQX4ZcwUTX%2FNPy0UI7YTR3%2FGaNh8Czqy2sn%2Fllu0OCkMY%2BeIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp%2B%2B7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED%2BYR%2Bjcl%2B4XrR5AMXTKfb53QRkFYdfsTgzVighku3b%2F2LHX9yK3kTQt5vagK9npvja%2FZiTSTu%2BDja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6%2Fa0Gc%2FvadCwwqL8UyVtuw%2FLCH0nXaBBNSLIbgm%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=fa54e3f1-d59f-4196-86d2-be796777c4e6&l_pb_bid_id=7624b801f137c4c8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=afea056b-de53-4e59-990b-2b59e4d5e95e&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.5553536866400306
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: bd72b830e73cf1615bd6851e60a9cd35d20f8f19c9cf895e2145209e7255ea78

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 145 B
605 B 480ms
347ms Fetch
application/json 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8acc63c0054944b9859809e310a3b3eebbf0706c838c304e7a6d3c01a427d38

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 944039ba8a7c9091-LAX
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 488ms
233ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

83dcccdb4849fd505bd0f1d89f520a403104f7d9b2c1d1cb8f7b0413f2889d94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 470 B
1 KB 422ms
145ms Fetch
application/json 68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b56ac68cb68ea16e05fc57d5f2d3cc385d28977cdbf0f332db64b9c64008e56

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 1651fcd7-f1a7-4885-af57-e6f85720bd0a
content-length: 470
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:08 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
626 B 535ms
272ms Fetch
application/json 3.167.112.86
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.112.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-112-86.iad55.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 3b79b27a5bad796a8d5be8e3080a7a185142dd26eeea5ba08fdcf44a8afdaff8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 9c8267a15d9ba974cf1dfcbe6981ef96.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: BqQfL-BCANznjFotz_PULUAQvTj8PT47PNFRzpNmMSYy2raGpnngow==
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
x-amz-cf-pop: IAD55-P8
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 456 B
634 B 543ms
272ms Fetch
application/json 98.82.168.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

98.82.168.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

89336867d0a98b5fa71dc670bfc9ec331c284315f7ac980315b5f469e0099216

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 278
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 817 B
814 B 542ms
272ms Fetch
application/json 98.82.168.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

98.82.168.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0066674c02784fc7cf708b6353da92dce27034ce6750c720e1ff8234ddc5ab00

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 458
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 401ms
132ms Fetch 98.82.168.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

98.82.168.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 523ms
253ms Fetch 98.82.168.206
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

98.82.168.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 441ms
164ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:08 GMT
server: nginx

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 392ms
124ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=22084972843&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:07 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 251ms
109ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 7d3baee7e4c4c46cf3a16b220074f6732411802c3d3d94e5d3a8c93dbc70413f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.244
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/plain
vary: Origin

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 398ms
127ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 39 B
664 B 250ms
108ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46e4526e99cd9b00afc7e9fe4d73acc096954aad5a76a0d3c0b894f0c770af68

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zdllu4aTOzNMugYZyaIRkR0V8mdpCzVtPgF9tLCbjwTmzQNQyqLhlJaKuuExINpynrzMDVqE78u1mxbsFAxow%2B9qqVq0iuBzBrLmfbQS0I1uKrvgZMvzDAl8XynrIr0SfZj4NpnJ"}],"group":"cf-nel","max_age":604800}
cf-ray: 944039babc082f4a-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 39
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
585 B 456ms
155ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 23:52:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
585 B 446ms
163ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 23:52:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
585 B 456ms
151ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 23:52:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
585 B 456ms
148ms Fetch 146.190.187.147
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.187.147 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 22 May 2025 23:52:08 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 468ms
164ms Script
application/javascript 104.94.117.85
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: swxqz.videounlimit.com
URL: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.94.117.85 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-117-85.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Fri, 23 May 2025 00:07:08 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 22 May 2025 23:52:08 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 153ms
149ms Script
text/javascript 3.167.69.51
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: swxqz.videounlimit.com
URL: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-51.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 18722
via: 1.1 c8e5a51ce52caf510dff11d206de43ac.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1B8BPU_KRpooJWMhNFfuvv5X2sV3T-i1Z2IkblJykcO-A3AJvQDQdQ==
date: Thu, 22 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 246ms
92ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&_it=amazon&partner_id=403
Requested by: Host: swxqz.videounlimit.com
URL: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3032
cf-ray: 944039bafeee2ad7-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 27 May 2025 23:52:08 GMT
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 332ms
188ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 12
expires: Fri, 23 May 2025 00:52:08 GMT
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
x-amz-id-2: ARTLOF8fvdJnwyqyxlCCsrr8nEuEGjLNVvlfOIL0Dbmn9IPS8Kd6yX6w43ZN1UEzGWEll+Brz2mHqyqopOErhh8GiGDyF7PNIW65mFnCJy0=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 9JYTHC4H5NNPE555
cf-ray: 944039baeea02b74-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 463ms
161ms Script
application/javascript 104.94.117.85
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: swxqz.videounlimit.com
URL: https://swxqz.videounlimit.com/moz6htw4t791p1ny033tx1v1RTDJQQnM1YmY0T3ppNmNRWVk5VVQtMzEyMy0yNTg0OTA3Ny0wZmJhMDI3NC00Nzg4LUlVeDVWekJoZXRIaFJIWG1pWnVp/5iiequxepp5/8lfKWH1USZc9ho/898608696484117952007970373908093
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.94.117.85 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-117-85.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Fri, 23 May 2025 00:07:08 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 22 May 2025 23:52:08 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 414ms
124ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 1119ms
127ms XHR
application/json 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1747957928021&did=did-0046&se=e30&duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.vide...
https://rp4.liadm.com/j?dtstmp=1747957928021&did=did-0046&se=e30&duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.vid...

13 B
370 B

504ms
138ms

Fetch
application/json

34.192.100.217
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1747957928021&did=did-0046&se=e30&duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.videounlimit.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 34.192.100.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-100-217.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: bda7954b-77c1-467e-a9c3-b85e06a750b5
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1747957928021&did=did-0046&se=e30&duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.videounlimit.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo0
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 22 May 2025 23:52:08 GMT

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 278ms
109ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 278ms
111ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=0fL4NK13l-mcJlnOhHAV-96fa694e79&sid=aPq2ecYj-V3bdZc9Zej-96fa694e79&cv=2.1.102&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:08 GMT
vary: Origin

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 08BA 0
412 B 405ms
129ms Document
text/html 52.20.28.114
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.28.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-28-114.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 22 May 2025 23:52:08 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 397ms
125ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 641ms
206ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:07 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MkhDR1ZqejhSak1lWlJrWVJGRVliWVBiNkFqa3Z0UHZzc1I2YThiZDBLeXc&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MkhDR1ZqejhSak1lWlJrWVJGRVliWVBiNkFqa3Z0UHZzc1I2YThiZDBLeXc&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

224ms
125ms

Image
image/gif

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:08 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Thu, 22 May 2025 23:52:08 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&bid=1e2n4ou

70 B
440 B

126ms
125ms

Image
image/gif

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:08 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&bid=1e2n4ou
content-length: 191
date: Thu, 22 May 2025 23:52:08 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-HjatrktE2pV.ctLJMG8KD8MyN90Re5oWPd4-~A&gdpr=0

70 B
440 B

126ms
125ms

Image
image/gif

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-HjatrktE2pV.ctLJMG8KD8MyN90Re5oWPd4-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:08 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-HjatrktE2pV.ctLJMG8KD8MyN90Re5oWPd4-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2702923651640957650&newuser=1&referrer_pid=m51mh00

70 B
440 B

700ms
478ms

Image
image/gif

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2702923651640957650&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:09 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2702923651640957650&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 23:52:08 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=4044189102943046563&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

132ms
126ms

Image
image/gif

3.234.8.37
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=4044189102943046563&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.234.8.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-234-8-37.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 22 May 2025 23:52:09 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=4044189102943046563&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 41f60182-8aed-4d40-b29a-194bd4d79bd8
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:08 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 121ms
121ms Script
application/javascript 104.94.117.85
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.94.117.85 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-117-85.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Fri, 23 May 2025 00:07:08 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 22 May 2025 23:52:08 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 AGSKWxXhBZ7Aziypl_PY8rjlllyh7X8rKepotSHkFLqzALj76mRBkPZrnaK3z7m1Ai2qsFVrxpTDKFzVK3YoC59-hMH5TlZmBJSzNGkY2IQZRshFCY-yqMiR2V6I8V7tN8mgNFHioXdVDw== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 153ms
152ms Script
application/javascript 2607:f8b0:4004:c19::66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXhBZ7Aziypl_PY8rjlllyh7X8rKepotSHkFLqzALj76mRBkPZrnaK3z7m1Ai2qsFVrxpTDKFzVK3YoC59-hMH5TlZmBJSzNGkY2IQZRshFCY-yqMiR2V6I8V7tN8mgNFHioXdVDw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3OTU3OTI4LDUzMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJvYUs3YUZvX2YtVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzd3hxei52aWRlb3VubGltaXQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

333f58b847129c8041d6fe52cf7273447e2d1f818ce86dc9a480c587c897a881

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EUcWbEa4caO-CJFmv8ockg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmII1pBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIh2PFx30H2QQaFk9ZzqSkkZRfGJ-cn1dSlJlUWpJflJacllqcWlSWWhRvZGBkamBqZKBnYBBfYAAABsRDCQ"
content-security-policy: script-src 'report-sample' 'nonce-EUcWbEa4caO-CJFmv8ockg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 03E1 102 KB
28 KB 371ms
123ms Document
text/html 142.251.167.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1679
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:24:09 GMT
expires: Fri, 23 May 2025 00:14:09 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 394ms
139ms Script
application/javascript 2600:9000:27c2:1c00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:27c2:1c00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3588
x-cache: Hit from cloudfront
x-amz-cf-id: XAiRNURXt08DnKXjXnQMAJMpn60btmjvFAAe47LVBgQd77OoJDd__g==
date: Thu, 22 May 2025 22:52:21 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 2cd91b399d7db009d02ca3e5944f2eca.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: IAD61-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 198ms
62ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 666202
x-goog-stored-content-encoding: gzip
expires: Fri, 15 May 2026 06:48:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 15 May 2025 06:48:46 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwqQ3cK0YoGx_uXG6j0gqdsrI5WggkF9xKRcPR_W71-VCnQr_EiOeK00Gm3-5ipV1sdNUfSKanI
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 361ms
229ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 0120e06f61c76049720db96fd8db37ac

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 214ms
77ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 299383
cf-ray: 944039beaf5cf7d5-LAX
expires: Sun, 25 May 2025 23:52:08 GMT
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 472ms
232ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 23 May 2025 23:52:08 GMT
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 462ms
146ms XHR
application/json 2606:ae80:1471:16::820
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:16::820 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Fri, 23 May 2025 00:22:09 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame F976
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
379 B

381ms
130ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 23:52:09 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 23:52:09 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

GET
H2 200 AGSKWxUe-DJz_CQrl_z8z3vxvIaFNYcQVZW7KXhW_CsGcV3o_MI2VyUriwuO-sWqaVqOQ3BiB07um_3NDHkiD-3gwStAscam4ZtNLx99TZVW0T0stQVqAjdGCjYs_KXVpirW4HIIvD_WUw== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 153ms
152ms Script
application/javascript 2607:f8b0:4004:c19::66
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUe-DJz_CQrl_z8z3vxvIaFNYcQVZW7KXhW_CsGcV3o_MI2VyUriwuO-sWqaVqOQ3BiB07um_3NDHkiD-3gwStAscam4ZtNLx99TZVW0T0stQVqAjdGCjYs_KXVpirW4HIIvD_WUw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3OTU3OTI4LDc2MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwib2FLN2FGb19mLVUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwic3d4cXoudmlkZW91bmxpbWl0LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::66 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d498fb231598750a312a58c8c45dd13431af77068ba0393e1301413f6c239b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qCNDjFWsksQHQkLN3C5hIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw1ZBiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIh2PFx30H2QRWLLw_mVlJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyEDPwCC-wAAADrJDWQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-qCNDjFWsksQHQkLN3C5hIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 542ms
282ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 23:52:08 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 180719
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 213ms
212ms Fetch
text/plain 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 629ms
207ms Fetch
application/json 2001:41d0:701:1000::16f1
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::16f1 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: ca0c713a614901c25bad3310d377bfce8232cd5188d848fd0e684066a1464617

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 215ms
207ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 210ms
210ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

894b3041c40ab5a125e2ded8ca3c06a0405188a73aad6400bc3d30a90f0b3308

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 23:52:08 GMT
content-type: application/json
vary: Origin

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 255ms
117ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 3296
cross-origin-resource-policy: cross-origin
cf-ray: 944039c148f62eeb-LAX
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 22 May 2025 21:02:11 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
265 B 85ms
82ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7ec8313921850a7ac248ed9849bd1d12d01ec0cbc1bbc4b4640a3c2153d9dd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 944039c1f93ed7a7-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 229ms
86ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 944039c16f84d7a7-LAX
content-length: 0
content-type: text/plain
date: Thu, 22 May 2025 23:52:09 GMT
expires: Fri, 22 May 2026 23:52:09 GMT
server: cloudflare

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 817ms
677ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: f0fa8d8d3c895fed1d1cc9b044334ddbd29535102515e4e88a02b944cad73a03

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
x-cloud-trace-context: 3dc8ee9b20cdb9fb7af262897142568a
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
11 KB 851ms
849ms Fetch
text/plain 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=7905503727216132&correlator=1358091596498138&eid=31092628%2C95353384%2C83321073&output=ldjh&gdfp_req=1&vrg=202505190101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1747957929136&lmt=1747957929&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fswxqz.videounlimit.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1Kk4tWEY3X3dtX3lwR00wZDRKZ19lUDhkSEpjMXRjckV0STZnamhSZ1lPT1ljSzRzR2hxWTYxeHl1MjZpNDdOMFBYARI0CgpwdWJjaWQub3JnEiRlYmJkOTE5YS0wMzJmLTQ4N2ItODBkOS1jNTk3YmU1M2MxMDVYARInChJydWJpY29ucHJvamVjdC5jb20SD01BQzRSTDJZLVUtNVMwT1gBEj8KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHWFCbXk0TkhNNFhJQUJ5dm9BZzJTWUFBQSYyNDMyWAESNwoNYmlkc3dpdGNoLm5ldBIkNTg1ZTZiZGUtMjhiNS00MzlkLTlkM2UtYTg2YjBmNjBmYjY0WAESNgoMcHVibWF0aWMuY29tEiQzQjIzMTc4Qy00NTQzLTQzOEQtQkIzNy1ENUNGQjlDMDYwQUFYARIdCg5lc3AuY3JpdGVvLmNvbRjepKXT7zJIAFICCGQSGAoJeWFob28uY29tGL2opdPvMkgAUgIIbxIUCgVvcGVueBjEpqXT7zJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGN6kpdPvMkgAUgIIZBIXCghydGJob3VzZRjepKXT7zJIAFICCGQSMwoJb3BlbngubmV0EiQ1MGZlZDk5NS0wZmE1LTRlMzMtOTc5Yi1iNzkzMDkyMmFlNjFYARKHAQoObGl2ZWludGVudC5jb20SczE2LXpaNlM1N0M1Wkc0eWF5SmVLUmwzS1BxM2FJSGMxNFA0SS9mVncyNVFLR0wzbzU3MHJtR011TXhOclViTUl4TDZZaFV3UElBZnVTR0V1djJVRjhiSFQ2MmVPalh5QWsrYWJFdUg5Y2plM1p4VzNBPT1YARI0ChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhU4NDU2NDA0Mzc0OTMzNzg5MjM2MzVYAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1747957925227&idt=2371&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3Dd71bcd7bd37e40649ad883d9115e1a6e57927786%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fswxqz.videounlimit.com%252F%26tyche_code%3DV.20250515.1%26pageos_code%3DV.20250515.1%26config_id%3D1024872_74068_primary_config%26hour%3D13%26day%3DThursday%26referrer_domain%3Dswxqz.videounlimit.com%26OS%3DLinux%2520null%26browser%3DChrome%2520136%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250515.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=32835&tan=3311319b-389b-44ce-a399-7142b2052350&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17eb87a0dd58c4b02ebeade5ffb8651f5d09c6c6ba6774a2649fb30fd70fcba1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 11080
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 1A48 7 KB
3 KB 405ms
135ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:52:09 GMT
expires: Thu, 22 May 2025 23:52:09 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 122ms
121ms Script
application/javascript 104.94.117.85
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.94.117.85 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-94-117-85.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Fri, 23 May 2025 00:07:09 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 22 May 2025 23:52:09 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 229ms
87ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 78fc170b19458ff34f484a8bc21e32ac76e6011a472cda56dc90950546b668d0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 215
cf-ray: 944039c3fb0f7cdd-LAX
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 22 May 2025 23:43:06 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
95 B 267ms
121ms Image
image/gif 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&halo_id=060ixeeju6a659a66666666666666666666uommwi0e0y6e000000000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c3ff9ddbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 298ms
94ms Image
text/html 44.231.152.158
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.231.152.158 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-231-152-158.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&adnxs_id=4044189102943046563&gdpr=0

43 B
95 B

151ms
151ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&adnxs_id=4044189102943046563&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c42feadbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&adnxs_id=4044189102943046563&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 661a6470-da86-4950-a002-3002d5b2790f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:09 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001747957929-EWWOXCDF-8ILE%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001747957929-EWWOXCDF-8ILE%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=53a94084-1dd8-44d7-9dcc-1f694d521046&id=AU1D-0100-001747957929-EWWOXCDF-8ILE&auid=AU1D-0100-001747957929-EWWOXCDF-8ILE

43 B
95 B

111ms
110ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=53a94084-1dd8-44d7-9dcc-1f694d521046&id=AU1D-0100-001747957929-EWWOXCDF-8ILE&auid=AU1D-0100-001747957929-EWWOXCDF-8ILE
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c549b6dbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=53a94084-1dd8-44d7-9dcc-1f694d521046&id=AU1D-0100-001747957929-EWWOXCDF-8ILE&auid=AU1D-0100-001747957929-EWWOXCDF-8ILE
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001747957929-EWWOXCDF-8ILE
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001747957929-EWWOXCDF-8ILE
https://ids.ad.gt/api/v1/pbm_match?pbm=42E4C4C4-FE53-4561-8D64-7CE42E840DAC&id=AU1D-0100-001747957929-EWWOXCDF-8ILE

43 B
118 B

113ms
112ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=42E4C4C4-FE53-4561-8D64-7CE42E840DAC&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c64b04dbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=42E4C4C4-FE53-4561-8D64-7CE42E840DAC&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:09 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001747957929-EWWOXCDF-8ILE&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&rub=MB010PBW-S-KWZY&gdpr=0

43 B
95 B

110ms
109ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&rub=MB010PBW-S-KWZY&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c579f3dbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&rub=MB010PBW-S-KWZY&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001747957929-EWWOXCDF-8ILE&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&id=AU1D-0100-001747957929-EWWOXCDF-8ILE

43 B
94 B

161ms
120ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c3ff9fdbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
content-length: 259
date: Thu, 22 May 2025 23:52:09 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001747957929-EWWOXCDF-8ILE&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001747957929...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001747957929-EWWOXCDF-8ILE&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001747...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=80f79f95-8181-4b52-96ee-11327463226c%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&ttd_puid=80f79f95-8181-4b52-96ee-11327463226c%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&tapad_id=80f79f95-8181-4b52-96ee-11327463226c

43 B
95 B

142ms
142ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&tapad_id=80f79f95-8181-4b52-96ee-11327463226c
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c67b89dbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&tapad_id=80f79f95-8181-4b52-96ee-11327463226c
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 22 May 2025 23:52:09 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 146ms
142ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001747957929-EWWOXCDF-8ILE

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001747957929-EWWOXCDF-8ILE
https://ids.ad.gt/api/v1/amo_match?turn_id=2702923651640957650&id=AU1D-0100-001747957929-EWWOXCDF-8ILE

43 B
170 B

124ms
118ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=2702923651640957650&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c40fa4dbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=2702923651640957650&id=AU1D-0100-001747957929-EWWOXCDF-8ILE
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 23:52:08 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&uid=172aabc5-a6d4-4fb1-a7bc-c91ef1a2e423&gdpr=0

43 B
95 B

109ms
109ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&uid=172aabc5-a6d4-4fb1-a7bc-c91ef1a2e423&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c579eddbd1-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001747957929-EWWOXCDF-8ILE&uid=172aabc5-a6d4-4fb1-a7bc-c91ef1a2e423&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 23:52:09 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-172
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001747957929-EWWOXCDF-8ILE
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzk1NzkyOS1FV1dPWENERi04SUxF

170 B
188 B

132ms
132ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzk1NzkyOS1FV1dPWENERi04SUxF

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:09 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 944039c40fa3dbd1-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0Nzk1NzkyOS1FV1dPWENERi04SUxF
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 211ms
210ms XHR
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

afc6acf6c4e25bc5a5983c230ddeb4df76b85c22ac939d7639a2e748757a0b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
vary: Origin

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame F976 44 KB
11 KB 121ms
121ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f404ce7dbb1341a58bf9aadf5bf22f2b98d38f61d8e1567b88fd29e5e5fd0421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

Response headers

cache-control: max-age=59594
content-encoding: gzip
expires: Fri, 23 May 2025 16:25:23 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Thu, 22 May 2025 23:52:09 GMT
last-modified: Thu, 22 May 2025 16:25:23 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 324 KB
113 KB 132ms
132ms Script
application/javascript 142.250.31.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-44-194-65-56.compute-1.amazonaws.com

Software

Google Tag Manager /

Resource Hash

ec5311ed897fb2071b9841ed28563fde6bdd75205c4a9833bbc534ee514a6dcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Thu, 22 May 2025 23:52:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 116162
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 136ms
130ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 944039c4bdf42eeb-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 264ms
114ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 944039c59b000922-LAX
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:09 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 846 B
282 B 114ms
112ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c601f2dd111bffcca1f8edef601829262234913998c4b59189a01d38afbea76b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 944039c6b82969cd-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:10 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 326ms
176ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 944039c5aee969cd-LAX
date: Thu, 22 May 2025 23:52:09 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H/1.1

200
OK

id5
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*eUVC5rKGeCMIk8BxaK9ZNonnosQj0jYkbQikjFa4v-8cK12ZiEBNHPes1k_FTVaK&gdpr_consent=undefined&gdpr=false
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

43 B
433 B

497ms
125ms

Image
image/gif

44.194.65.56
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

44.194.65.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
Server: gunicorn

Redirect headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
location: https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 23:52:09 GMT
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H3 200 select Show response
fundingchoicesmessages.google.com/f/AGSKWxWr6UqaSe_WVkSYaEzKywccxVBy0i9KioNCtWXERjVz_fBybZwpJD1M0EfCnHVyZl5w-D3VBWH_-xSzYmGmPqvQVtq3_uO6ymThCHUppYrdIM0nZsfWnE1h5yFYfTChfqPQVJuv3PvzsTZHiXUTdw3W5Dg9M... 54 B
109 B 139ms
138ms Script
application/javascript 142.251.111.139
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWr6UqaSe_WVkSYaEzKywccxVBy0i9KioNCtWXERjVz_fBybZwpJD1M0EfCnHVyZl5w-D3VBWH_-xSzYmGmPqvQVtq3_uO6ymThCHUppYrdIM0nZsfWnE1h5yFYfTChfqPQVJuv3PvzsTZHiXUTdw3W5Dg9MrwwcesLybcSRq4-bPYW02yXd_iSCB9i/_/ad/130-/admeasure./ad/select?/oas_ad_/adhood.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

966fab1d770f3a862e7502773e3758dd2c01f8795254d6b19a2dcdb663377355

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-sZRTa29KPwcaVgJ1ljUsjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjqtDikmLw1JBiOHnrNtNFIG69eY51OhAbrT3P6gLEhgqXWJ2B-P66S6zPgfhD_WXWH0BcJHGFtQWIP1XdYBWpvsGaxH6TtQSIQx1vssaCcNpN1lQg3rXxFuthIG7Svs3aBcRmfrdZ7YBYiIdj5cd9B9kEVtxZ18ispJGUXxifnJ9XUpSZVFqSX5SWnJZanFpUlloUb2RgZGpgamSgZ2AQX2AAAF6lSGY"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-sZRTa29KPwcaVgJ1ljUsjQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 68 KB
25 KB 373ms
123ms Script
text/javascript 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

69df9520e73d741f328f7a40e279710499d1e2af1a81de60b2be855802f0745c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 69234120874071566
age: 695
x-content-type-options: nosniff
expires: Fri, 23 May 2025 00:40:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 23:40:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 25553
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxXqzf23NU04S8CHDfwe1Pqa0sv_K1REaGZAICpyUt0PdZ7KwcuYNYI6mCSaalQgUQK9IV5pMvyQFndqTP9zmY_wjhTR1soXkN0RV3w4ySTmjqIF3Vapkns2XYDASxXtwcSQICMLJw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 271ms
142ms XHR
text/html 142.251.111.139
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXqzf23NU04S8CHDfwe1Pqa0sv_K1REaGZAICpyUt0PdZ7KwcuYNYI6mCSaalQgUQK9IV5pMvyQFndqTP9zmY_wjhTR1soXkN0RV3w4ySTmjqIF3Vapkns2XYDASxXtwcSQICMLJw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-oYxpaQ0EsE45FYzvFVvsFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII0JBi-FB_mfUHEJv53Wa1A2IhHo6VH_cdZBOYcaZtP7OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLUMzCLLzAAAJ9xJ4c"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-oYxpaQ0EsE45FYzvFVvsFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 4120 20 KB
7 KB 120ms
119ms Document
text/html 23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=105527
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 23:52:09 GMT
expires: Sat, 24 May 2025 05:10:56 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXqzf23NU04S8CHDfwe1Pqa0sv_K1REaGZAICpyUt0PdZ7KwcuYNYI6mCSaalQgUQK9IV5pMvyQFndqTP9zmY_wjhTR1soXkN0RV3w4ySTmjqIF3Vapkns2XYDASxXtwcSQICMLJw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MlrDMWAwGDJGYkUhnY4N4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1JBi-FB_mfUHEJv53Wa1A2IhHo6VH_cdZBN48fnNEWYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSoZ2AWX2AAANqNKFo"
content-security-policy: script-src 'report-sample' 'nonce-MlrDMWAwGDJGYkUhnY4N4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 4120 2 KB
3 KB 384ms
125ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=74317039&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0f06f46ba6c19ec0894de89e975c74911273bf594abe264017b25814c4e0ed28

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 22 May 2025 23:52:09 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 container.html Show response
8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 931C 7 KB
0 1ms
1ms Document
text/html 142.250.31.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:52:09 GMT
expires: Thu, 22 May 2025 23:52:09 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 3064 1 KB
2 KB 339ms
132ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: aa432f837c3139337de0a37e5c517295b7d5c8edb8d17646c405c5b06f4b2a27

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1093
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:10 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame C764 0
0 396ms
128ms Document
text/plain 67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:10 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame A9DD 269 B
379 B 132ms
131ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 23:52:10 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 6E55 803 B
1 KB 298ms
148ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 2a75381de8cea1d0885e64f073426338efb38a6ea1afeb1b1578eb26bdd6b849

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Thu, 22 May 2025 23:52:09 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame 5CDD 11 KB
4 KB 277ms
131ms Document
text/html 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d202273d84cb263b8bf9141c076b372fe862f194b9a25f0971804458b0aeca1c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 944039c80c1d7c85-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:10 GMT
expires: 0
last-modified: Thu, 22 May 2025 11:19:15 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame A8C0 3 KB
2 KB 461ms
78ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 213
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 944039c98a4cd12a-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 22 May 2025 23:52:10 GMT
expires: Fri, 23 May 2025 03:52:10 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame F0DE 20 KB
7 KB 121ms
120ms Document
text/html 23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=105526
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 22 May 2025 23:52:10 GMT
expires: Sat, 24 May 2025 05:10:56 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CACF 2 KB
1 KB 361ms
119ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:52:09 GMT
server: Kestrel
server-processing-duration-in-ticks: 73417
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 02DD 52 KB
17 KB 425ms
142ms Document
text/html 23.215.0.49
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.0.49 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-215-0-49.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 22 May 2025 23:52:10 GMT
ETag: "623de86a-cf34"
Expires: Fri, 23 May 2025 23:52:12 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 222ms
216ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
660 B 133ms
132ms Fetch
application/javascript 52.200.238.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.238.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-238-32.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: d854920e272b660cc980894483566bb03c5868adef0ff104b22274d12b9ca920

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 93ms
89ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=sKH7RQXJw8sZ7GsGcJrQKs0UcrjJHTifboz7jGbRKNk%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: b39a793967e421c0ecb27f21c083c432b254e511338d0bcc2b868d086b5bce65

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 482 B
0 3ms
3ms Fetch
text/plain 52.4.88.156
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jvx6jkjyr629ygf6c2b07hhh&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.4.88.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-88-156.compute-1.amazonaws.com
Software: /
Resource Hash: 498c358a4a00ccf797c69eb746174cec8c96fb2c0b8c7f14c06243befff06390

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 6416baa79ffc94b8
request-time: 10
access-control-allow-credentials: true
expires: Fri, 23 May 2025 23:52:07 GMT
access-control-allow-origin: https://paint.toys
content-length: 482
date: Thu, 22 May 2025 23:52:07 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 122ms
122ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=Jj2Qa18zc01sRHNJbDRyQ05mbkdZSDNUYWlhRmlYbW9KRUhaOXd2UWwxVkdCQ2l4MCUyRjdTczUxMjM0YWRsQkdSJTJCU1E1QlpLZnc4NE94aVV0cEh6TEh4Q3FuekU0Y1olMkJsbkJNc1VwcnNHajFNTGl2VGwyUSUyRkpwaXNDaWRxSk8wRHJCSHI2&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 268471
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

123ms
122ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 22 May 2025 23:52:11 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=themediagrid&gdpr=&gdpr_consent=
https://cms.quantserve.com/pixel/p-zLwwakwy-hZw3.gif?idmatch=0&ssp=themediagrid&gdpr=&gdpr_consent=&__qcmcs=1
https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=themediagrid&&user_id=81Au5adQfeHoWCy7oA0xtqRZfrboWiuw9AqIWnOQ

43 B
103 B

134ms
133ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=themediagrid&&user_id=81Au5adQfeHoWCy7oA0xtqRZfrboWiuw9AqIWnOQ
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://x.bidswitch.net/sync?dsp_id=76&user_group=2&ssp=themediagrid&&user_id=81Au5adQfeHoWCy7oA0xtqRZfrboWiuw9AqIWnOQ
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 124ms
120ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 22 May 2025 23:52:09 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 224791
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame AC50 652 B
254 B 585ms
327ms Document
text/html 142.251.179.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRCVoM7WAhjXqOS5AjAB&v=APEucNW8jlDFiJQF4s1zMG1j2WX0Agcx0wHlfraDEPAYXB622UdJinyzQN2QrZm67IN7wq_sOtk6P00u7KfniOG0YpCaNxVlxHk5SbCuAAaQ5Ea69cxjs4A

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f154.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:52:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 931C 110 KB
37 KB 447ms
183ms Script
text/javascript 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6355a7bcb2412bbb25a722e48636b58b050a7a4af7a68258919f7306e85de618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 17872117406929459988
x-content-type-options: nosniff
expires: Thu, 22 May 2025 23:52:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38120
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 42 B
63 B 670ms
408ms Image
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BAODSCTR4wX31ddHb4Pfm7uJdRT6aSWQ2FoNl42Y873ilHfBj1fhNYTMMQnudp_oNuuJva_fxY-Hreav6HMdHYI-QH9LpLAMoTtOQtyZ-P-ttQxjE

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 / Show response
a1.adform.net/adfscript/ Frame 931C 3 KB
3 KB 406ms
131ms Script
text/javascript 185.167.164.53
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://a1.adform.net/adfscript/?bn=80646549;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CwPLWqbgvaNqFEdGOqMwPjZfhoAfY68-Hf5nTt6CpFPnWl7_wChABIPub1UlgyZ72hoCAoBmgAZjUmaoByAEJqQL3qIYECuyyPqgDAcgDmwSqBOsBT9DF3eiv0_4dlA-2Td8U38rFqL4VdMm0uHuVzORho8u5MP8x6IAWnuaDAzmxZrFpIA90rAJQR_-RkzyH2Rebk-5NIt_kmXIll9_3cn29lFCKTPz-AX5nR_VhGtuyPqD_uZ5WR0T7zD0Xvv1ptGF5RBxF2SZCWzUvuc54n41q64F3dgvpVaYx4D1Y8pL0xPlBjRZc7_OlinZ5IXhoihu9KD9CvyCudRYW4LekLGs1WneqX3O3p29xvtfI1p_KraOBgpeaDAQueDn3dsSSuvawynMY_nc1U1L_ryC65lfgMmHjl3vq6WLHBYl6IcAE966_mqkF4AQDiAXavon0U5AGAaAGTYAH0Kvm1QKoB9XJG6gH2baxAqgHtrmxAqgHpr4bqAfz0RuoB5bYG6gHqpuxAqgH4L2xAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgHmgaoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwDSCCkIgGEQARidATICigI6DYBAgMCAgICAqIACoANIvf3BOli5u9HboriNA4AKA5gLAcgLAYAMAaIMCCoGCgTaz7ECqg0CVVPiDRMIxunR26K4jQMVUQeKAx2NSxh06g0TCPK40tuiuI0DFVEHigMdjUsYdPANAbATqIDQHNgTCtgUAdAVAfgWAYAXAbIXqgEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAwQgUIhY_4L-gXBLIYCRICkVQYTSIBAA&ae=1&num=1&cid=CAQSOwDZpuyz5xpm30cC9VooE9G3YG6gm_SWfgwxYTjdMVuwwsUTo9Wvow6CZS92g0v_CZ5FbTkwvlr-Z6AXGAE&sig=AOD64_0SkjHRAlmR6wZutJTKEFsmiKyJ1A&client=ca-pub-5812357352335075&dbm_c=AKAmf-BreyqrCusBtrffzMX6It6UEX0wd3qR7zOdJQdSNgniHnd7z-0ES8VvnxmoXUlvWmR4aQGvRODikna7Mtc490th1vh7r_7-elKQtPFYFu_qK7wkeaTyeecxLEC26SfqeJc-z4jvpqWIOXhwJiAO2S7iEkayHCDDiv4LU_bGwoAT4GgFfI5AT8AQEFJpbYUVc_8_mlY_2LHcf7_IwrWoD5rNLtKuZ-rEsPH023GaOloIYIStRYHHUVm6rGBvpeNhy_41gknN9Ozu2VlQx83gOmVhl6_Owg&cry=1&dbm_d=AKAmf-BTNyq35T4zHxflNWQVbxbDK4BPd77fSkZ1sWiLoNPfV3Nn6yTDOLCZSJnehQO3XSnkfmp_4iWJVtemdozqsRKhV2NJWAux9v_iiUZyJ6ABTdbNCwZPdzHmdxWl2DNoJZ2J4sS_-401A_yI1mxVWxTMuSFERmBz5inxi6AeEh3Jkl22c1-o8X8dJzbSYHPg9MpQct4E__B_AaRRuwy4YoKchtcy_kTpq74gbOU-2LCpw16_NVBLc1kU-13HfN4BJqjxT9gKO4L2vueeQqHEZJpFvRc-iVDZNJo2sqdfjofIFGFqs8vjztZf7ZvSo0e809bSPsLywBxWDgMGD3hYqEet-IafCv6JAwlXlzyCb4G-VfQnurLYK0z0VgIwbOkVMUzgSLbF75HfT3Xw970DQLg5ZZm5gAHk0MUGsrrkYH5yTwOnP7jbX7EUVMkOTq0eZnYKkeL0P9Y2oOz4QEi4PULDb4Q1LkTgKwzVI6lGq7PlHoLrN3q_Yj3J8AMdgApGrG_0d5ftfgjOmjBBK7WqARCo74x33pGqBPIQ8nJH0j7vBEKBVi4Tp3thEi3SOfL8gVe99ekuwWkhcf5dUa9FOyzK0UCSJ74ZOR8m5WRWj8Fv-cLt_HggKsuYW4Z_5em_J3t4VzA6qDXFM9FrxcdDEciDyGLndLmkH_DRKCguTvcB-qzUpKE&adurl=

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

028b8af439c834a816a45b83cdd80fcb817ca16861f52dcb5cfcb346b9b6142e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
access-control-allow-methods: GET,POST
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-origin: *
server: nginx

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/ Frame 931C 3 KB
2 KB 381ms
127ms Script
text/javascript 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/window_focus_fy2021.js

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 40636
x-content-type-options: nosniff
expires: Thu, 05 Jun 2025 12:34:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 12:34:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/ Frame 931C 19 KB
8 KB 380ms
127ms Script
text/javascript 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

760e5d0b97d6707a3d5c2c949bd70e7668484a144f383f3a4dfa878bad15e8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 3000748235154339481
age: 40323
x-content-type-options: nosniff
expires: Thu, 05 Jun 2025 12:40:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 12:40:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 931C 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 931C 221 KB
68 KB 394ms
134ms Script
text/javascript 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

cafe /

Resource Hash

9fc89654aff6bca6c890b30bd0833eb2f18d63a61c0a9ece5246537ad6f73c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 81102085050987160
age: 822
x-content-type-options: nosniff
expires: Fri, 23 May 2025 00:38:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 23:38:28 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69707
x-xss-protection: 0
server: cafe

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame C745 5 KB
2 KB 217ms
73ms Document
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 195
apigw-requestid: K_hRohnZvHcEPKw=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 944039c888daf7b3-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 23:52:10 GMT
last-modified: Thu, 22 May 2025 23:11:57 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 543ms
142ms Fetch
text/html 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505190101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.253.62.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bc-in-f157.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A9DD 44 KB
0 121ms
121ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: f404ce7dbb1341a58bf9aadf5bf22f2b98d38f61d8e1567b88fd29e5e5fd0421

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=59594
content-encoding: gzip
expires: Fri, 23 May 2025 16:25:23 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Thu, 22 May 2025 23:52:09 GMT
last-modified: Thu, 22 May 2025 16:25:23 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame F976 7 B
1 KB 513ms
127ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19ea072139d67f7022c6e463249c998e
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 8F3A
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=0&gdpr_consent=

35 B
591 B

128ms
127ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 22 May 2025 23:52:10 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 22 May 2025 23:52:10 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame EE6B
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9D9BDDC-D273-4502-A8F9-A6056EF53565&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9D9BDDC-D273-4502-A8F9-A6056EF53565&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

150ms
149ms

Document
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9D9BDDC-D273-4502-A8F9-A6056EF53565&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 22 May 2025 23:52:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: KAG54PNCG1K5J7RA4MSV

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 22 May 2025 23:52:10 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=F9D9BDDC-D273-4502-A8F9-A6056EF53565&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: S98E3VHNZ4C0HM909XTH

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4E31
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4044189102943046563&gdpr=0&gdpr_consent=

42 B
218 B

345ms
118ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4044189102943046563&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 22 May 2025 23:52:11 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: d1e465cc-665f-4d38-96aa-6ad9b4e76b20
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:10 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4044189102943046563&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame CCE2 0
833 B 214ms
146ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=F9D9BDDC-D273-4502-A8F9-A6056EF53565
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 944039c95ab1b860-LAX
content-encoding: br
content-type: text/html
date: Thu, 22 May 2025 23:52:10 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957930&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=bql1b7UVbYHjwOtmTxEOBTc4pawTTQxUmk2iTsHdHgA%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957930&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=bql1b7UVbYHjwOtmTxEOBTc4pawTTQxUmk2iTsHdHgA%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H3

200

396846.gif
idsync.rlcdn.com/ Frame 4120
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=F9D9BDDC-D273-4502-A8F9-A6056EF53565
https://idsync.rlcdn.com/1000.gif?memo=CIbVGRIwCiwIARCMowEaJEY5RDlCRERDLUQyNzMtNDUwMi1BOEY5LUE2MDU2RUY1MzU2NRAAGg0IqvG-wQYSBQjoBxAAQgBKAA
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=2f2f2687-5913-4d4b-914e-8bca63b6be9a

42 B
60 B

111ms
111ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=2f2f2687-5913-4d4b-914e-8bca63b6be9a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=2f2f2687-5913-4d4b-914e-8bca63b6be9a
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame 4120
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-pHsaGPJE2pTt7tAAuBA9DiIJp24AM0Zk6w--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&icm&gdpr=0&gdpr_consent=&cver
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=15096902d23dd7fccffa25525aa4f94a&gdpr=0
https://bidberry.net/?partner=1&mapped=98c6056369b2a65b&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=47df3df869558429699d9c0002a634e6&gdpr=0&redirect=

35 B
245 B

209ms
208ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=47df3df869558429699d9c0002a634e6&gdpr=0&redirect=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=47df3df869558429699d9c0002a634e6&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Thu, 22 May 2025 23:52:13 GMT
pragma: no-cache

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame 4120
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=F9D9BDDC-D273-4502-A8F9-A6056EF53565&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=F9D9BDDC-D273-4502-A8F9-A6056EF53565&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=F9D9BDDC-D273-4502-A8F9-A6056EF53565
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=4044189102943046563&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=2702923651640957650&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
175 B

217ms
217ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aC_4rAAAG-g69AAq
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1747957933.098319,VS0,VE0
age: 3180
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 22 May 2025 23:52:13 GMT
content-type: image/png
x-served-by: cache-toj-leto2350039-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 15

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aC_4rAAAG-g69AAq
x-timer: S1747957933.784398,VS0,VE93
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
x-served-by: cache-toj-leto2350039-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RjlEOUJEREMtRDI3My00NTAyLUE4RjktQTYwNTZFRjUzNTY1&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

132ms
123ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4120
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-dm93NJzRQKo-aYFbvU1ZQ%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

119ms
118ms

Image
text/html

23.221.241.44
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 23.221.241.44 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-221-241-44.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=105526
content-encoding: gzip
expires: Sat, 24 May 2025 05:10:56 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 22 May 2025 23:52:10 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

251ms
117ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:A3A280CD0FF64F968E54253B3B3D69A4

42 B
514 B

359ms
118ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:A3A280CD0FF64F968E54253B3B3D69A4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:A3A280CD0FF64F968E54253B3B3D69A4
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 21 May 2025 23:52:10 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=

42 B
542 B

372ms
119ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 22 May 2025 23:52:10 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wR1Ul9NE2uWMEh48fO86Xk83g0WiwG4-~A&gdpr=0

0
260 B

387ms
130ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wR1Ul9NE2uWMEh48fO86Xk83g0WiwG4-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-wR1Ul9NE2uWMEh48fO86Xk83g0WiwG4-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/html
server: ATS

GET
H2 200 F9D9BDDC-D273-4502-A8F9-A6056EF53565
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 4120 43 B
518 B 405ms
131ms Image
image/gif 2600:1f18:4e9:5a05:af03:3ba0:d8e5:4cb9
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/F9D9BDDC-D273-4502-A8F9-A6056EF53565?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:af03:3ba0:d8e5:4cb9 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 4120
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=06be1dbe-853d-480b-a243-7d4374770841&gdpr=0&gdpr_consent=

1 B
256 B

120ms
119ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=06be1dbe-853d-480b-a243-7d4374770841&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: 5e5c8bdb-7116-4a59-a375-cee64a959280
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=06be1dbe-853d-480b-a243-7d4374770841&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXqzf23NU04S8CHDfwe1Pqa0sv_K1REaGZAICpyUt0PdZ7KwcuYNYI6mCSaalQgUQK9IV5pMvyQFndqTP9zmY_wjhTR1soXkN0RV3w4ySTmjqIF3Vapkns2XYDASxXtwcSQICMLJw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-coSHVe2e8yvqSLZi6aQ0ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0JBi-FB_mfUHEJv53Wa1A2IhHo5VH_cdZBO4MXfnOUYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSoZ2AWX2AAALChJ8k"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-coSHVe2e8yvqSLZi6aQ0ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXqzf23NU04S8CHDfwe1Pqa0sv_K1REaGZAICpyUt0PdZ7KwcuYNYI6mCSaalQgUQK9IV5pMvyQFndqTP9zmY_wjhTR1soXkN0RV3w4ySTmjqIF3Vapkns2XYDASxXtwcSQICMLJw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-FET9pyrTSak_xX6uWw0ltQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw15Bi-FB_mfUHEJv53Wa1A2IhHo5VH_cdZBO48ePFBUYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSoZ2AWX2AAAN7-KGQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-FET9pyrTSak_xX6uWw0ltQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxX_AW4fuJFP7KUJmAOSJ8mBJtJbLNgjmzfyGijIZ9e-NrvSc2YRax8hu_QZ6gO_VIp4eKXJA6GkhwOTrOzlwEJ90w1XPuylVtQrgQqTZyQxNDODP92OY-vPl-nDj97BVkaedo6H6w== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 167ms
164ms Script
application/javascript 142.251.111.139
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX_AW4fuJFP7KUJmAOSJ8mBJtJbLNgjmzfyGijIZ9e-NrvSc2YRax8hu_QZ6gO_VIp4eKXJA6GkhwOTrOzlwEJ90w1XPuylVtQrgQqTZyQxNDODP92OY-vPl-nDj97BVkaedo6H6w==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ3OTU3OTMwLDM1MjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJvYUs3YUZvX2YtVSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJzd3hxei52aWRlb3VubGltaXQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

ESF /

Resource Hash

17a188cb73dc2faa9d72ca34d85ca1259f7cab82bc206a8dec5463c0eac2a870

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_ce33-o0vCacFQbNc1qe0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:10 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw05BiaL15jnU6EButPc_qAsSGCpdYnYH4_rpLrM-B-EP9ZdYfQFwkcYW1BYg_Vd1gFam-wZrEfpO1BIhDHW-yxoJw2k3WVCDetfEW62EgbtK-zdoFxGZ-t1ntgFiIh2PVx30H2QRunNx_lVFJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyEDPwCC-wAAAJSJD1A"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-_ce33-o0vCacFQbNc1qe0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 211ms
210ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 22 May 2025 23:52:09 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 5CDD 19 KB
7 KB 228ms
82ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 944039c9feffe13e-LAX
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 6E55 170 B
232 B 405ms
147ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 6E55 170 B
232 B 403ms
146ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NTY4NjhhMmItNWQyMy0yNThmLWRiZDctNTE4MDkwY2YxMTIy

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6E55
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=7ae959e1-9454-7b2b-ce37-0b395a2ddf42&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&google_error=15
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

170 B
188 B

136ms
134ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
content-length: 423
date: Thu, 22 May 2025 23:52:11 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6E55
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/ee2e3fa5-04f8-e962-ffe0-1dcca57a120b?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1YRpXJE2p8yi784YYnPL.EVZan5FtjjYWk-~A

43 B
136 B

89ms
86ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1YRpXJE2p8yi784YYnPL.EVZan5FtjjYWk-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-R1YRpXJE2p8yi784YYnPL.EVZan5FtjjYWk-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 23:52:10 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 6E55
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC_4qwAR2OQ8ugBh

85 B
171 B

222ms
218ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC_4qwAR2OQ8ugBh
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1747957931.323021,VS0,VE0
age: 2478
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/png
x-served-by: cache-toj-leto2350039-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 1695

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aC_4qwAR2OQ8ugBh
x-timer: S1747957931.962674,VS0,VE94
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
x-served-by: cache-toj-leto2350039-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 6E55
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2702923651640957650&gdpr=0&gdpr_consent=&us_privacy=

43 B
97 B

96ms
86ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2702923651640957650&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2702923651640957650&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 23:52:13 GMT

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame 5CDD 4 KB
1 KB 248ms
247ms XHR
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 941e36ffa30af1330af21a62f5516c573e42d17a0eb9ba8d6c91c3e486f8dff2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 944039c91d5c7c85-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2

200

xuid
eb2.3lift.com/ Frame 3064
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

145ms
132ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 22 May 2025 23:52:10 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 3064 170 B
232 B 373ms
147ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3064
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzkzMDQ4MDk0NTU4NzE1OTg1MzI0

170 B
409 B

217ms
142ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzkzMDQ4MDk0NTU4NzE1OTg1MzI0

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzkzMDQ4MDk0NTU4NzE1OTg1MzI0
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:10 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 3064
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MzkzMDQ4MDk0NTU4NzE1OTg1MzI0
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

130ms
129ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 3064 0
650 B 560ms
178ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=393048094558715985324&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 159858FD34F14F33AD7276697B47D223 Ref B: LAX311000113035 Ref C: 2025-05-22T23:52:10Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1wiuM5lmRMb/xc5iRIw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-source-fabric: prod-lor1
date: Thu, 22 May 2025 23:52:10 GMT

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 3064
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=393048094558715985324
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

43 B
576 B

504ms
125ms

Image
image/gif

2600:1f18:ed:550f:79be:79d2:f5d7:8df9
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:79be:79d2:f5d7:8df9 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 17e27fa1145ccdc8
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
Content-Length: 0
Date: Thu, 22 May 2025 23:52:11 GMT
trace-id: 22ec7520c8ee29ca
Request-Time: 0
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame 3064
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/393048094558715985324?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-3SqtkolE2oRAYzUt9uy1kjAyAnlxEV6LayANdXr0tA--~A&dongle=0883

37 B
474 B

135ms
134ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-3SqtkolE2oRAYzUt9uy1kjAyAnlxEV6LayANdXr0tA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-3SqtkolE2oRAYzUt9uy1kjAyAnlxEV6LayANdXr0tA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 23:52:10 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 3064 42 B
689 B 595ms
94ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=393048094558715985324&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: F387251E227C4116AF33D740EEAB9661 Ref B: LAX311000109051 Ref C: 2025-05-22T23:52:10Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 3064
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=5ad6f7e1107c055f&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN_toOwyoPYAJmk5bkAQEBAQEBAQCX-2hdfAEBAQEBAQEB&expiration=1748044331&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

132ms
132ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN_toOwyoPYAJmk5bkAQEBAQEBAQCX-2hdfAEBAQEBAQEB&expiration=1748044331&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN_toOwyoPYAJmk5bkAQEBAQEBAQCX-2hdfAEBAQEBAQEB&expiration=1748044331&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 3064
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430

37 B
474 B

134ms
133ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Content-Length: 141
Date: Thu, 22 May 2025 23:52:10 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 112ms
109ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 944039ce1b0869a4-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:11 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 696ms
114ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 944039cd5a2669a4-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:11 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame C745 0
140 B 245ms
115ms Ping
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 944039cc6eab69d1-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 22 May 2025 23:52:10 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 259ms
125ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 944039cadd312ec0-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:10 GMT
server: cloudflare
vary: Origin

POST
H3 204 AGSKWxWNrCBsc2N3HZIrTOLP1eikWvri1OLgWBcfhXnOdbkQdKjSszQe9_ry4cXKkYYKKSg-_SfiPLFy3WZb6lQNMuPvSJinTlCSWPpmXAaFTgkaeRNeFs_5EPGFEwpaa-jqNfS5714DVw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 142ms
139ms XHR
text/html 142.251.111.139
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWNrCBsc2N3HZIrTOLP1eikWvri1OLgWBcfhXnOdbkQdKjSszQe9_ry4cXKkYYKKSg-_SfiPLFy3WZb6lQNMuPvSJinTlCSWPpmXAaFTgkaeRNeFs_5EPGFEwpaa-jqNfS5714DVw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.139 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YX1ViFqNJ7Vy_z6WvPZGVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:10 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1pBi-FB_mfUHEJv53Wa1A2IhHo5VH_cdZBOYsHDFUSYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSoZ2AWX2AAAJbPJ28"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YX1ViFqNJ7Vy_z6WvPZGVQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 02DD 0
796 B 124ms
123ms Script
text/html 68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 0df52589-80e5-4029-bf2c-08267e28b8ac
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 5CDD
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-ozone&gdpr=0&gdpr_consent=
https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&gdpr=0

0
305 B

157ms
154ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&gdpr=0
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 944039ce4a917c85-LAX
expires: 0
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://elb.the-ozone-project.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&gdpr=0
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 29af2665c43893332e84c235bac366c1
content-length: 0
Content-Type: text/html

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 210ms
208ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

0bd2ef82b58193c91b0d71b761e288617c7ec15f0986180ee15b52a6a37285c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 22 May 2025 23:52:10 GMT
content-type: application/json
vary: Origin

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame AC50
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0

43 B
337 B

87ms
81ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRCVoM7WAhjXqOS5AjAB&v=APEucNW8jlDFiJQF4s1zMG1j2WX0Agcx0wHlfraDEPAYXB622UdJinyzQN2QrZm67IN7wq_sOtk6P00u7KfniOG0YpCaNxVlxHk5SbCuAAaQ5Ea69cxjs4A
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZP6IARmZ7hNXDRfiZzPmI4xjwue7pXaEFzTryj1k%2Be3pD3cbeLh5uQgfg1Q6qM6Zzr5dI8xmDvzqF%2FVn4pq1YpjpqSNDyBAqv4awrBLdnRVIEiMGWChRQqfvW9qp85edlnkjqRuehwwDLw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 944039cd4f3fdbc6-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame AC50
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aC.4qsAoIngAFq4kAcoPGAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
802 B

91ms
90ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRCVoM7WAhjXqOS5AjAB&v=APEucNW8jlDFiJQF4s1zMG1j2WX0Agcx0wHlfraDEPAYXB622UdJinyzQN2QrZm67IN7wq_sOtk6P00u7KfniOG0YpCaNxVlxHk5SbCuAAaQ5Ea69cxjs4A
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VDZY7LeFAA0WChS9%2BlgmfXz4iCm9wp2oQHGKSeq79p5hRISxb4tumFf3qRqJP6XgPEYyvfSbidXeL%2FdgLa%2B26I%2BUGsXeuyWVdONbTlwKE5nTGWea%2Fb5RXvHDNlnHzf98hJfvqwRwQzZ4Kw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944039ceccfb7c27-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame AC50 170 B
232 B 291ms
283ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRCVoM7WAhjXqOS5AjAB&v=APEucNW8jlDFiJQF4s1zMG1j2WX0Agcx0wHlfraDEPAYXB622UdJinyzQN2QrZm67IN7wq_sOtk6P00u7KfniOG0YpCaNxVlxHk5SbCuAAaQ5Ea69cxjs4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame AC50
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NDE4OTEwMjk0MzA0NjU2Mw%3D%3D&gdpr=0

170 B
232 B

160ms
159ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NDE4OTEwMjk0MzA0NjU2Mw%3D%3D&gdpr=0

Requested by

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDA0NDE4OTEwMjk0MzA0NjU2Mw%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: b71f0cd7-494a-4c18-8fb4-aeeafee7ab7d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 sync Show response
eb2.3lift.com/ Frame E9B4 1 KB
2 KB 130ms
129ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 874d1296ba9f93f5f2e94b5763317bb88d9a445e2c180ae003fcece4d8cc0efd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1171
content-type: text/html; charset=utf-8
date: Thu, 22 May 2025 23:52:10 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

setuid
prebid.intergient.com/ Frame F976
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY&us_privacy=1NNY&khaos=MB010PBW-S-KWZY
https://prebid.intergient.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY

0
980 B

147ms
147ms

Image
text/html

104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957931&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SHZ5xNEa1EgBcPga76SJLD2XYPkQJaNKwUzVCVjRjW0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957931&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SHZ5xNEa1EgBcPga76SJLD2XYPkQJaNKwUzVCVjRjW0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944039cebb57b860-LAX
server: cloudflare

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://prebid.intergient.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
content-length: 0
Content-Type: text/html

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YzY2MzVmYzkzY2ZiODBhNzIxMWUxYzBlNzNmZGQwMWFlYzQzYzk3OQ&us_privacy=1NNY

170 B
232 B

136ms
132ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YzY2MzVmYzkzY2ZiODBhNzIxMWUxYzBlNzNmZGQwMWFlYzQzYzk3OQ&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YzY2MzVmYzkzY2ZiODBhNzIxMWUxYzBlNzNmZGQwMWFlYzQzYzk3OQ&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame F976 43 B
855 B 146ms
141ms Image
image/gif 98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 473P8A5TCZE076HJX1A7
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 22 May 2025 23:52:10 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F976
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038&google_error=15
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

170 B
188 B

138ms
137ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=ZGIyZTM0YjItNTc3Zi00ZWRiLWExZWQtN2U2ZjdkYjBlMDM4&google_push&gdpr=0&gdpr_consent=&ttd_tdid=db2e34b2-577f-4edb-a1ed-7e6f7db0e038
content-length: 423
date: Thu, 22 May 2025 23:52:11 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIwMTBQQlctUy1LV1pZ&us_privacy=1NNY

170 B
188 B

136ms
134ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIwMTBQQlctUy1LV1pZ&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-154-76.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIwMTBQQlctUy1LV1pZ&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 29af2665c43893332e84c235bac366c1
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F976
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=MB010PBW-S-KWZY&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

136ms
136ms

Image
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MB010PBW-S-KWZY&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: CT06QNHNCGWZ8DP5XZPT
Content-Length: 43
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MB010PBW-S-KWZY&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
content-length: 0
Content-Type: text/html

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame F976 43 B
855 B 704ms
281ms Image
image/gif 67.220.226.238
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

67.220.226.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: QC790E8DQK8ZTS5PPPFQ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame F976 170 B
232 B 145ms
139ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-229-193-108.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:10 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/EsH0JABsoCvX2HVRtruwEA?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-mxZOaKlE2oKgi9HCD058u5fsbNwYcIkE6OrSGQ--~A

42 B
1 KB

121ms
121ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-mxZOaKlE2oKgi9HCD058u5fsbNwYcIkE6OrSGQ--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-mxZOaKlE2oKgi9HCD058u5fsbNwYcIkE6OrSGQ--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

60909
i.liadm.com/s/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=49096&us_privacy=1NNY
https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB010PBW-S-KWZY&us_privacy=1NNY

43 B
600 B

125ms
125ms

Image
image/gif

3.229.193.108
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB010PBW-S-KWZY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

3.229.193.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 834b1ca0ce4da794
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB010PBW-S-KWZY&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB010PBW-S-KWZY&us_privacy=1NNY

0
156 B

142ms
142ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB010PBW-S-KWZY&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 55F460516FD04A5A8BE2D3A945C0F83F Ref B: LAX311000113035 Ref C: 2025-05-22T23:52:11Z
x-li-fabric: prod-lva1
x-li-uuid: AAY1wiuVWOZOvomtp2v9UA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB010PBW-S-KWZY&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F976
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AANz2E7QX3EAABs9xrHQOw&expires=30

42 B
1 KB

123ms
123ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AANz2E7QX3EAABs9xrHQOw&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AANz2E7QX3EAABs9xrHQOw&expires=30
Content-Length: 0
Date: Thu, 22 May 2025 23:52:11 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame F976
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1NNY
https://sync.a-mo.net/setuid/magnite?uid=MB010PBW-S-KWZY&us_privacy=1NNY

0
720 B

372ms
128ms

Image
text/plain

125.253.89.175
SS-ASH

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MB010PBW-S-KWZY&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 125.253.89.175 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Thu, 22 May 2025 23:52:11 GMT
x-envoy-upstream-service-time: 2
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MB010PBW-S-KWZY&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
pbs.yahoo.com/ Frame F976
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange&us_privacy=1NNY
https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY

0
456 B

406ms
160ms

Image
text/html

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-envoy-upstream-service-time: 0
age: 0
x-envoy-decorator-operation: pbs--production-usea5.mediaplatform-gcp-prod-monetization.svc.cluster.local:4080/*
referrer-policy: no-referrer-when-downgrade
expires: 0
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html
vary: Origin,Accept-Encoding
server: ATS

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: a0d1cefc91c6f8b22fd2adf3abe06a61
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame F976
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&us_privacy=1NNY
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY

43 B
1 KB

157ms
156ms

Image
image/gif

68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 8f677ce6-d231-45fe-b0c5-9245d362fddb
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB010PBW-S-KWZY&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 29af2665c43893332e84c235bac366c1
content-length: 0
Content-Type: text/html

GET
H2

200

receive
pixel.tapad.com/idsync/ex/ Frame F976
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1NNY
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB010PBW-S-KWZY&us_privacy=1NNY

95 B
765 B

220ms
91ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB010PBW-S-KWZY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB010PBW-S-KWZY&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F976
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=06be1dbe-853d-480b-a243-7d4374770841&expires=30&us_privacy=1NNY

42 B
1 KB

122ms
121ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=06be1dbe-853d-480b-a243-7d4374770841&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: ac936329-9da9-4fe8-8352-071875c79a3e
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=06be1dbe-853d-480b-a243-7d4374770841&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=&_bee_ppp=1
https://eb2.3lift.com/xuid?mid=7255&xuid=AACBA07QX3EAABq8VKFCAw&dongle=bzwx&gdpr=0

37 B
474 B

136ms
134ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AACBA07QX3EAABq8VKFCAw&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AACBA07QX3EAABq8VKFCAw&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Thu, 22 May 2025 23:52:11 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame E9B4 43 B
1 KB 145ms
125ms Image
image/gif 3.208.163.69
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.163.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-163-69.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame E9B4 43 B
168 B 142ms
124ms Image
image/gif 3.208.163.69
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.163.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-163-69.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=42f1ffde-aa19-411c-b571-2c5db1c60283&dongle=d54f&gdpr=0&gdpr_consent=

37 B
474 B

133ms
133ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=42f1ffde-aa19-411c-b571-2c5db1c60283&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: fb64fba9-3bb9-487a-8d8f-0016fca019d1
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=42f1ffde-aa19-411c-b571-2c5db1c60283&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Thu, 22 May 2025 23:52:11 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=3c1ac332-6e10-44a5-b417-df4f18cb3c91-682fb8ab-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=3c1ac332-6e10-44a5-b417-df4f18cb3c91-682fb8ab-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3D3c1a...
https://eb2.3lift.com/xuid?mid=3646&xuid=3c1ac332-6e10-44a5-b417-df4f18cb3c91-682fb8ab-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
474 B

133ms
133ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=3c1ac332-6e10-44a5-b417-df4f18cb3c91-682fb8ab-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=3c1ac332-6e10-44a5-b417-df4f18cb3c91-682fb8ab-5553&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
server: Jetty(11.0.25)

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=393048094558715985324&gdpr=0&gdpr_consent=
https://r.bidswitch.net/sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=triplelift&bsw_param=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b
https://eb2.3lift.com/xuid?mid=2409&xuid=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
474 B

133ms
133ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //eb2.3lift.com/xuid?mid=2409&xuid=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:11 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=2702923651640957650&dongle=d407&gdpr=0&gdpr_consent=

37 B
474 B

1166ms
1163ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=2702923651640957650&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=2702923651640957650&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 22 May 2025 23:52:10 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame E9B4 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=1be326c8-877e-446c-875d-c064a538d8e9&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=1be326c8-877e-446c-875d-c064a538d8e9&gdpr=0

37 B
474 B

132ms
132ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=1be326c8-877e-446c-875d-c064a538d8e9&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=1be326c8-877e-446c-875d-c064a538d8e9&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame E9B4
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=A3A280CD0FF64F968E54253B3B3D69A4&dongle=yf3

37 B
474 B

134ms
132ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=A3A280CD0FF64F968E54253B3B3D69A4&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=A3A280CD0FF64F968E54253B3B3D69A4&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 21 May 2025 23:52:11 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 setuid
prebid.intergient.com/ Frame E9B4 0
896 B 145ms
143ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=393048094558715985324
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957931&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SHZ5xNEa1EgBcPga76SJLD2XYPkQJaNKwUzVCVjRjW0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957931&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=SHZ5xNEa1EgBcPga76SJLD2XYPkQJaNKwUzVCVjRjW0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944039cd4ee7b860-LAX
server: cloudflare

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 0
20 B 132ms
132ms Ping
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7437541493407&version=m202505060201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 0
20 B 134ms
134ms Ping
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7437541493407&version=m202505060201&ct=77&x=1&cor=14546998538469800000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 931C 37 KB
21 KB 164ms
164ms Script
text/javascript 142.251.179.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B7Y2yQMyxcHbQH-DA6zdRPyBBXxVrBcaH4vrFwTEbmQmMo92Cel05HB6EWliAGSFqZksdappdB4egupDjaVWBF8aEG-vxEe8e3Jfwsl1Cc7hWlY7oLFRBWRrnP9Eale28ENblcshWqKpBX5Lat_oOCiJhqU1uan7ohNb-rA_9nsG66UtyQNZmWUhaSeY1fv-F7_aXy-OwwDRtcz2M_ygGvy8VCyRpGTqw31wDBfb1E6GQC2apsXNba5Nm-Gjy4stEqSMzPYDRQedbBU_kkyLXfkKMsUg&cry=1&dbm_d=AKAmf-AiGv9TLvOVBj6w_YQYo-A75zivd7mJTYblo_Z6u0OxWWvzhzqdhriTZJTuwdzYp5BvLFE6eCfoC5ZBH6pMaaXvhYk10K2rPf3VR2M7AITROnQQTfBrBhvuuRkNjVGh8LDNYWcyDKC63BpdvPKtTcUc3fcKKMS4rSn1j9efyHO9M8ZgbV5x-51jxppXpWlQhH4bNkaX_yn01a-Gw8Z-prVLzzt3GhHKBdoThLMofovx-WqgsZ0bwOccuMI70MQmCpC9iSH53yXjP4d7dmJ2v53ah7as903_KwxNN10SGicMqXgo1pjBVpBzvpQ5-Cnln52w4WB8PMkyirX6HfU8JWVJQwDB2nhbFDT-aoNv4NlgmY1_9_vYHqOsCxothUfx9YG-B8srbGM8deyLPuPadcmD_32tQFppnUYmfxqUmnKd8O_MkSSjlaxusQppM3pETzBba8v-W3wkcScFKy4DvF3IRhKzUozJoacWkP8DzWPnM4-z12vJC_ZsDauXc3DYf68cr-aOzd4des_0WdN_SivpR558yQ9Dbbgv_Us-dLJ-T4duo90Smc37pQ6mHLsPGtFky4oTd16GzQUq6MkumdgbtWypXeimK-MPSOsohy22cfdcVkFgirfWVYarCgbrqT1A6jzt0WnmDCI214Ks4ougg53Gx1ggBRvje01SsVPVTa7anXE4H5WbQxOKmnMi6eoNfCXWDXiGyJp2I2fARsILI9YaSqT1K4qd4xqc8UIRaos9eD8C4kK2-3GpQQJPeq7irgMxXML6WMZaowmNg_MvH0le63MVP4cDWMB7hXxK3erUQD18YFZeLPHRORwPdD58oH0EyCuzUiuaqHl04mze9x9VcL886sfB2r1_lAs3Xyn9MTYiTxXzgUHGtBdnT0a0CaozOgITSjiWzMa80j1rUNrXlrzyYl17frMvw2505Vn1RwJ1WmMN1n29LPIkX9r3cxaTvwVtVYv0qpCgqs2Boe65-k0ndvy-YXoHie4gSA_kHVsyqvxGfTfh2sK4gvty-X5edFYFKHy3wVcO7cDNw8BY3e1FyWMiehjyvJ-t_dtfS5haMyOpcsuT0ORwghfjiiGv9pklqBG5AiaKC_a1c9ob0WPpZfRJ7XoXTizZteVR2syVfWHl2clNrac_DJAxhEmBoZ5gA8gTnkDiMgDMsXB2c6gpshgLW6_kmE1z3wXHvMIRiscCTLsBzmA4N4TW8nZQG9Oy5hmtY1KEjniAbiVU6eMkC08Qjw7NyI90nX1JHC4SCmRj04j4PWcr4nPUHh4ZIZxZ0P4F3Fi1KxJdXFXAna0IYty65keuLIBe9s96j1akRlmUCcWxOpvGxdjbQeLb5LTuZWazeBJocOjPgrTNzdp-PwsdvhwOSOAv7CVWczIau94m2LVTEup_yrMVZu-tsh2yL3yFC4fXf5F3XSJdurvDyOTTw4f_ZKpFAqH4W-b835v7U4ZcY-jQRK2g12EB16sFWxKxqWwuZjsJQbZPI26JVgZdh5v9Po1wu2HA46sVHS3R4iI4wOBcwOKS9ITlHFsufQl1reKDSQ-U7zUDdLvHoszzsu9Y7jdz7QvyyuYKBTh8zoxnlcPtovyzfnUaMQnXBnfZRdSTiAQc6qa8c3ZtzUdfRdEIU2HpGv8fWpDtgW4CZoq_xtFw8epMtheooDE7WLIoWZvtByV43AA0N0NKKLR15aXE43H8YP3xn36U0t-_sZJiJUwIzhNSrAyNYne__5T77jZLAEmnTvLRjEbKkkgRGlid_K1nHTFKGeoVfNywJZTTLu2WHLMqOqCRkxW2PPeMHQhPZmsuHuhOh_YPCbXIW9UcvJTggm6Pojt_9lgmNWf0GqxKQIYr1-21T1rfaYkFJPoPr92l2RbDjSBItrt1hyX_2ebFk6eGERRhWs_b9A0I_cqO_LXzZw26EqQn1woL40jYkL-283ooPEe6Eoqs3w8gn5rnU8WAnh4XKFEPGI8YToCBf7Bq7SEkXWU29VTWok10UQNy55TsBVSxFSXCm3k0UdFflZz7-OpFaLHNvj7MRsqPip0-9ngo9nLRpJMJKGK4KMADcyNm31hHYYdfRajZBikc0Yafw6VvbV8VjL4CEz78URb-5vTHsaMlnKgTbj4VHNE3CPT_1glxcdffefb0yBbxOXcnshLlRjU0-BuaA-izd_80GEmO9UShvYHFUJmEiibxBV9cdGFNYkO9J3c0zMrTxyX6eXKmmwBaJeU9uTKnm8cIv6YGU-PC_OrLp50s78vIrX9O5K2aN2-RsKlJNBJNogINBBn6xS5xIg_tMoz5oP1SrjrDNDJoDfgYYDsxkK7nccimxh7gLK3ggZyQv7QfQtEoBz9TZzjaW-htSxBarBWlIliD_g_AC_eCr1QbaQI3VeCx3DGH33ry7d4h8dc7b7kKsGPpkpvSpawT6DSQexCssygWPnxuanT2lmtsMTdNH3pi91sv40V48DEZMLPBeNto-IsiJLg4lyRvDLULefZb-95PWDBL47PKwuIkHAsGVNo-fsrA_f5f2fkgU_5NEA5cJwo1_GRxcC9nt9wi1iRMsZ5vznbVtycxP7tbMEVXtBl2J86yE4RwCIRs-BaCcjmUfc8sxD30_Wmg9_gYaRGROJ2Q1U0btis8Z0BTzCTefVY8nANliNr_Xh44DmpT_49pqRNNnhom21bX6U2EByW_XilV7lP1Dz3U08ggfeVNhhd-PMFaY3_zFI1q8l_HyKi-39kISIJ0Yjue10474s9bqQvmepbeBy9JjH_nsSGbbfsk7MXPezpRkS6-ma6q9roOzhqM2k7y8EQJITcXidjTdkhGPK7G3QtxLWzBtIVCz6u_Mau2mS6eRcsjQQiIeUvc8VePKAuUXGAObHus7qab2IwpCOJ3-mW0fgrkHo7Vrc36WuWBBfzgd5wn_VvD8XujHv491484zhnzTZsV8eFlKrwzh_gi61iAbYy779T1vFj4LrSH9tK30WYFvTtNFkGBOmb3zAFD2Hv9R40neqiO5X_vA6H749xuCN6neeDXzRA21yzE8qbB1XOiFwrmyptgvK0tnEnjL39oBTWzvsr_mY56c4ijrNqsWOzUUr7LDraNkz-kzqVRVJihQ6WcI67fvfXOvCU_doPWyMvJLLTUCHXftt_TpeErftD0gcbVz_Vyw3O7rKwVc4eXNHMOwB-tNLoLui4Il2wEKgew9Lzen_mvaiLlAJjLDGPsPaliHQimyt_QhUpBk26jwYblsKMYcKot5uQbOHA9_wxbrgxWfvn8rYlICRgRG3H5lDRkULdWDgyH_4iOPhU3tdUunbu0cafoS3q6exT3DWfuX_La4CE3-fLW2N5WFcSPB3DaMhH6U0nuiIGkQ6enTbREX_rTBwhZg27ef_ReHM85vrlBDxs07zfIo-oXZLxxek_QJJs1O8kkaGNyPM-g2hDeekRDzl2fAbAb4vwQXL5A35oHCmW5gxv6I-iHp5GkD_8cyKy8qOyf8ZvRSP22Nm5exjvD1a6pkybBg8vBAACHW0h_z7YM7lqfO45Dr3BqvRye0YtDz9VqvZQy_M5kuwusHtQI9ASV39ELEy3wDcGzAMR3xzfqByhGRr68NqcdrC_dWWyXrP6nDebFeAM2sF8kh4WdskdDmQiQz9UQ1RIfL1vGTAAtT5R-8h218VYEKWUHs-hBAQZIcpdlD5U-RUzbtxHiPLICTCUZ4mfIVyB96OXRgA9huwZAjHFT_QfKyfdGVC0RibEg2HhhLdNq9bIoow_KkRnyZG-IGaL1Z2cm_vSvPjw3FN3WwUQH1tl_MJtgNceDkdXxbCM4Ae_x5KY1ePdGOYMhBXHqzBAofp4f1NB01I7195Kua-qER_DKQ2dN14mhXPQ7z7jCPp5TC8EzGCJaMXRd5gjbOaKuRS8PGZdc0ZcZDHR3UJliEIhWeRhHjLAqRNFt8O4wfnVYPrm8MONBv3C9JoV1fIQXQjGr2JKJn6phwXGaZmM7gJKyxvhXU8kok9mGl7QVy9j2q_Vwts3wwCdCsRTF6JfoEBDJ48_RSh00lItFVg25cR-ZQZe4XVEgW--pMBlAW75Rz6VCydc1YkrefG63eI2gwrFtN2JFQohO77m6MLcLEEKsaMzDEslOpY1QlwYcd28DpKTR1NIEUDgRAxCpWhhXFCmiR-IMtVkFjwHx9-lvewUtwQ3-zpEMDcBB9riotZyG2839o1OPmhlWBLRWgqcRjGL3g5n1ABcC6v5RvjgnT-BcvNfg6wK_UzJAk6xjkPYlIfC4X-Mcfv7899N5T4gDaWkMAHVU7Y2GvWEx4y1YTp6JM3Y4vuyY4aDoMIjSbE4DKv_WNf9CM9TshaSfM8yU38KOF12DGCvCx3Ea_NM0EQSvX2qIuC3jD74p3RtjYhP1wm4CRhPNM0toMgtScA5wPUilGC40IQnP9Kp0L5xEWAKk-3gxbsXE25c3gbck4bsSAmVALG2WN6eyET4x1F-oignxj4AT4UKhAyIEwsyc4kRp1T-av4l_B7pAUZ9QG6r67ME3XrNypkTcIF4Xnoo_EG6D6VPco4DTTpmkFYE8cZiX2Y97vzxmA2e7iHXXPXLT6SrR8_VdmR0hfnKhp8i4iGji5Nf1p4GtFiQ3Hm35mfG0qMMI5O9Q76kMMwjzXiGUbioYjefw3YhuqPbq9_btAnZ8FyGGsc0Sf0TGSBX55dbrTfBs-KkCNR0tS_eVlSAURHpspRDzFPGDURgnNICt2pzhX3rqORKbcja4ChjME5U4zw4B53ZtAButGMQ4wyyAlpHdWlRk-mlM7rCDlIj5AX9X2AgBGmbnlCKhJ19ZAz8l0_d85VB0j-kPcU9GJAnMv_rOMrORqx_I1VImo8lAKvs3FEYFBqTwS7RPcfurJICMxdfTTPVW7XsYplV0JCdfBvrpYUUhdLTFH7Gbp8VW6E1az-dzs9s7yalVVnB6rychkEb-JkMLSqrVRpIa9KS0ihs7fFVzYDNYEr33igio4qjHvXW94o7MsOzi-9GD2Xu6DBHeHcQPJDL7w8urnM45m7UAASrqxhDtf6wBpp0s1RXSBn--s9PEAzH95HmIor-e6IffAncinTroUjk8xoS5huvaZ9AMc0JaUWJNUjeFf1HQ40oXUaHwKmmBiQqq3Tf6wIw_lFwpahiRDqyUYQXcF-JqhcNzpyq05M7-Ju0EFsi3i6kwLFLawkhl9wToK6etSTyk7odFWjYJTFvXz33ageoo5fwpTuye2mpmFZx35_a7hy6SYWnz4ElvHa9xtOkgzHmop1TMDvfPDT7geCeVYiLAnkg61IKzKEmtEJijFG_uDFKP7OE4ZXo4Oxwq3KTOqv8ElrNdwkMWm_qlMeDXK8bexd3L6Ds69MepxP2Y9vkuEogdr9K5Ty5KPRggcqQQwmQ4uFNGFdz18EpODyiQ32oYtfh1Q5uhtOQyDg-kzWLYdBVxmbfHTrA600MKbOGJ2ZebOcZ8Uv-Zom-u8EAd02mZ3iRJEmexAVN10p19-IAwAFWZCvrtddnck47NPQE3C0GOnm9KaexsOT_uz9jKF9YqqW6FWjkvPW_zIaxI1Oc-bGkIBOgc7myzaTWt8SAdEO51bKoWmMYQSSF5-udVwVQTH0-G5kfqXVsOeT2IJ8v09fhWGY76NK3qQtMUt9uot0uAROEiYCFGyWngHxtiqX9zyGaotplTyBVPa_u2qeDMJUC7ivTzfP7rUxnc0A_KeTJNWITb_MdQCsRiiPClcupE223Sav-nmivLSX95iwZEA7nzP0NGF20Thj4yugHDfHz90YF6GPNVfcnUlq83IajmXt_jUg52FtysY6aAMz2B_vV05uaErDJ6pNUUKY1NkP2F3cUnkHSWJfrS0aMG4ByR1R7fI6Tcs-S3589XNgRDVIPKVUBorVGhWPUvP7zdB0-3RzOGm50btUO8zOTfMxsFT_zRos4BTpsPl1p1sHfIEd65S5yZPMS4RtCkv3lyg0VMMc2wQy9ziIY3WeVxHZWvtGeUpL4xJmuwaHFXp_wTrvL_9WVjIvqsAANltJQn2-L-Wzfsnn4qEWBaEFuP4wkVxCSqqPJWYAOthjVtbACDoOdfSxebDsHEKR155YpTc4cLqv38KK8U8Z92Yk_12ANi4s3ryWSwhy_9yFQXkAQFMOlypIQ7DKTYn-gKNIk-V9m40f9v8AzFvTSfcYTTs2IgV0AtTWul3leyP_dGg_TFtuEp_JSxuElIwpsVay3fuBp9ot4gvgDeqkWNC9-8IoAOOh7037g54mxeLExzUEp9NGGa4UsGc2-6KTLEqFQOI_p0SxvDTWuxB9xRDoQIZHeDcUnaaYKsAUxyplXR72076WHS0Xx4omIp5vybxNRdpiIa6mgV8F4PMvdAvmkJLeOo8GmlHEqgWNZjLuAqUkwakA_JCT8qW_sqjf1YIODfkvDKRsaWBA26Ky7DpoSlu-bVvbXOHukyDPBTMYz9UZ8OTztRhk3TSXrwUQssl-As-LfrN5Pn88t_2FdjVUwYomgu3it2vrSMLxWrww9Tuy1RGIy1z3ooEfUzeinBE2nBrGF7W4nn7eBJMJwf_wRYkqRbHLVDFnVbUO7XT5okH7uEZ36YXfuVWO8azbnTndtHG9-mQIGhxN0HfXvtrTCUmIPF2W7l4b7RAslfpSyDcYCrTtUV7ZV-WlLYiOuHNQFJREDl7ceCL0m9Sxui24_hUd_-LK7uXwUYY7Kpr44V-p28JQVgxjaHgjJj3ebPWuR46WHCHDjmH0ecyUxNA74d4R7Ompye_GgdUZwck46M1fsrjiC0mFVg4KHTpDM6evgALW8Wj6E__I2h2Zf2iK8NmLQN78y9t5Pmf1cDcAYhhRXwWm-j_ECpnqQL7G8DNdqCaCZhy6NZWlFZiG32qlEvOIpj5Zno7PsAVnfHVLMYPwKACb5neQD3Dji6r129JDdqYttKV2TPbtYGhRi8xzfInsdklaXNBIhYkigmtu1B7GKU7FdDaDAy&cid=CAQSOwDZpuyz5xpm30cC9VooE9G3YG6gm_SWfgwxYTjdMVuwwsUTo9Wvow6CZS92g0v_CZ5FbTkwvlr-Z6AXGAE&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=14546998538469800000&adk=1033480540&idt=797&cac=0&dtd=82

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

pd-in-f154.1e100.net

Software

cafe /

Resource Hash

a6ad9742853bbf6269694a120c3d77bb4ac687722b19f4fc47b0009211464b4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 21210
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 131ms
129ms Fetch
text/plain 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55l1v9101576445za200&_p=1747957925255&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~103301114~103301116~104481633~104481635&cid=2071317095.1747957926&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1747957926&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.videounlimit.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=7&tfd=6696
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/ Frame 931C 29 KB
11 KB 123ms
123ms Script
text/javascript 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B7Y2yQMyxcHbQH-DA6zdRPyBBXxVrBcaH4vrFwTEbmQmMo92Cel05HB6EWliAGSFqZksdappdB4egupDjaVWBF8aEG-vxEe8e3Jfwsl1Cc7hWlY7oLFRBWRrnP9Eale28ENblcshWqKpBX5Lat_oOCiJhqU1uan7ohNb-rA_9nsG66UtyQNZmWUhaSeY1fv-F7_aXy-OwwDRtcz2M_ygGvy8VCyRpGTqw31wDBfb1E6GQC2apsXNba5Nm-Gjy4stEqSMzPYDRQedbBU_kkyLXfkKMsUg&cry=1&dbm_d=AKAmf-AiGv9TLvOVBj6w_YQYo-A75zivd7mJTYblo_Z6u0OxWWvzhzqdhriTZJTuwdzYp5BvLFE6eCfoC5ZBH6pMaaXvhYk10K2rPf3VR2M7AITROnQQTfBrBhvuuRkNjVGh8LDNYWcyDKC63BpdvPKtTcUc3fcKKMS4rSn1j9efyHO9M8ZgbV5x-51jxppXpWlQhH4bNkaX_yn01a-Gw8Z-prVLzzt3GhHKBdoThLMofovx-WqgsZ0bwOccuMI70MQmCpC9iSH53yXjP4d7dmJ2v53ah7as903_KwxNN10SGicMqXgo1pjBVpBzvpQ5-Cnln52w4WB8PMkyirX6HfU8JWVJQwDB2nhbFDT-aoNv4NlgmY1_9_vYHqOsCxothUfx9YG-B8srbGM8deyLPuPadcmD_32tQFppnUYmfxqUmnKd8O_MkSSjlaxusQppM3pETzBba8v-W3wkcScFKy4DvF3IRhKzUozJoacWkP8DzWPnM4-z12vJC_ZsDauXc3DYf68cr-aOzd4des_0WdN_SivpR558yQ9Dbbgv_Us-dLJ-T4duo90Smc37pQ6mHLsPGtFky4oTd16GzQUq6MkumdgbtWypXeimK-MPSOsohy22cfdcVkFgirfWVYarCgbrqT1A6jzt0WnmDCI214Ks4ougg53Gx1ggBRvje01SsVPVTa7anXE4H5WbQxOKmnMi6eoNfCXWDXiGyJp2I2fARsILI9YaSqT1K4qd4xqc8UIRaos9eD8C4kK2-3GpQQJPeq7irgMxXML6WMZaowmNg_MvH0le63MVP4cDWMB7hXxK3erUQD18YFZeLPHRORwPdD58oH0EyCuzUiuaqHl04mze9x9VcL886sfB2r1_lAs3Xyn9MTYiTxXzgUHGtBdnT0a0CaozOgITSjiWzMa80j1rUNrXlrzyYl17frMvw2505Vn1RwJ1WmMN1n29LPIkX9r3cxaTvwVtVYv0qpCgqs2Boe65-k0ndvy-YXoHie4gSA_kHVsyqvxGfTfh2sK4gvty-X5edFYFKHy3wVcO7cDNw8BY3e1FyWMiehjyvJ-t_dtfS5haMyOpcsuT0ORwghfjiiGv9pklqBG5AiaKC_a1c9ob0WPpZfRJ7XoXTizZteVR2syVfWHl2clNrac_DJAxhEmBoZ5gA8gTnkDiMgDMsXB2c6gpshgLW6_kmE1z3wXHvMIRiscCTLsBzmA4N4TW8nZQG9Oy5hmtY1KEjniAbiVU6eMkC08Qjw7NyI90nX1JHC4SCmRj04j4PWcr4nPUHh4ZIZxZ0P4F3Fi1KxJdXFXAna0IYty65keuLIBe9s96j1akRlmUCcWxOpvGxdjbQeLb5LTuZWazeBJocOjPgrTNzdp-PwsdvhwOSOAv7CVWczIau94m2LVTEup_yrMVZu-tsh2yL3yFC4fXf5F3XSJdurvDyOTTw4f_ZKpFAqH4W-b835v7U4ZcY-jQRK2g12EB16sFWxKxqWwuZjsJQbZPI26JVgZdh5v9Po1wu2HA46sVHS3R4iI4wOBcwOKS9ITlHFsufQl1reKDSQ-U7zUDdLvHoszzsu9Y7jdz7QvyyuYKBTh8zoxnlcPtovyzfnUaMQnXBnfZRdSTiAQc6qa8c3ZtzUdfRdEIU2HpGv8fWpDtgW4CZoq_xtFw8epMtheooDE7WLIoWZvtByV43AA0N0NKKLR15aXE43H8YP3xn36U0t-_sZJiJUwIzhNSrAyNYne__5T77jZLAEmnTvLRjEbKkkgRGlid_K1nHTFKGeoVfNywJZTTLu2WHLMqOqCRkxW2PPeMHQhPZmsuHuhOh_YPCbXIW9UcvJTggm6Pojt_9lgmNWf0GqxKQIYr1-21T1rfaYkFJPoPr92l2RbDjSBItrt1hyX_2ebFk6eGERRhWs_b9A0I_cqO_LXzZw26EqQn1woL40jYkL-283ooPEe6Eoqs3w8gn5rnU8WAnh4XKFEPGI8YToCBf7Bq7SEkXWU29VTWok10UQNy55TsBVSxFSXCm3k0UdFflZz7-OpFaLHNvj7MRsqPip0-9ngo9nLRpJMJKGK4KMADcyNm31hHYYdfRajZBikc0Yafw6VvbV8VjL4CEz78URb-5vTHsaMlnKgTbj4VHNE3CPT_1glxcdffefb0yBbxOXcnshLlRjU0-BuaA-izd_80GEmO9UShvYHFUJmEiibxBV9cdGFNYkO9J3c0zMrTxyX6eXKmmwBaJeU9uTKnm8cIv6YGU-PC_OrLp50s78vIrX9O5K2aN2-RsKlJNBJNogINBBn6xS5xIg_tMoz5oP1SrjrDNDJoDfgYYDsxkK7nccimxh7gLK3ggZyQv7QfQtEoBz9TZzjaW-htSxBarBWlIliD_g_AC_eCr1QbaQI3VeCx3DGH33ry7d4h8dc7b7kKsGPpkpvSpawT6DSQexCssygWPnxuanT2lmtsMTdNH3pi91sv40V48DEZMLPBeNto-IsiJLg4lyRvDLULefZb-95PWDBL47PKwuIkHAsGVNo-fsrA_f5f2fkgU_5NEA5cJwo1_GRxcC9nt9wi1iRMsZ5vznbVtycxP7tbMEVXtBl2J86yE4RwCIRs-BaCcjmUfc8sxD30_Wmg9_gYaRGROJ2Q1U0btis8Z0BTzCTefVY8nANliNr_Xh44DmpT_49pqRNNnhom21bX6U2EByW_XilV7lP1Dz3U08ggfeVNhhd-PMFaY3_zFI1q8l_HyKi-39kISIJ0Yjue10474s9bqQvmepbeBy9JjH_nsSGbbfsk7MXPezpRkS6-ma6q9roOzhqM2k7y8EQJITcXidjTdkhGPK7G3QtxLWzBtIVCz6u_Mau2mS6eRcsjQQiIeUvc8VePKAuUXGAObHus7qab2IwpCOJ3-mW0fgrkHo7Vrc36WuWBBfzgd5wn_VvD8XujHv491484zhnzTZsV8eFlKrwzh_gi61iAbYy779T1vFj4LrSH9tK30WYFvTtNFkGBOmb3zAFD2Hv9R40neqiO5X_vA6H749xuCN6neeDXzRA21yzE8qbB1XOiFwrmyptgvK0tnEnjL39oBTWzvsr_mY56c4ijrNqsWOzUUr7LDraNkz-kzqVRVJihQ6WcI67fvfXOvCU_doPWyMvJLLTUCHXftt_TpeErftD0gcbVz_Vyw3O7rKwVc4eXNHMOwB-tNLoLui4Il2wEKgew9Lzen_mvaiLlAJjLDGPsPaliHQimyt_QhUpBk26jwYblsKMYcKot5uQbOHA9_wxbrgxWfvn8rYlICRgRG3H5lDRkULdWDgyH_4iOPhU3tdUunbu0cafoS3q6exT3DWfuX_La4CE3-fLW2N5WFcSPB3DaMhH6U0nuiIGkQ6enTbREX_rTBwhZg27ef_ReHM85vrlBDxs07zfIo-oXZLxxek_QJJs1O8kkaGNyPM-g2hDeekRDzl2fAbAb4vwQXL5A35oHCmW5gxv6I-iHp5GkD_8cyKy8qOyf8ZvRSP22Nm5exjvD1a6pkybBg8vBAACHW0h_z7YM7lqfO45Dr3BqvRye0YtDz9VqvZQy_M5kuwusHtQI9ASV39ELEy3wDcGzAMR3xzfqByhGRr68NqcdrC_dWWyXrP6nDebFeAM2sF8kh4WdskdDmQiQz9UQ1RIfL1vGTAAtT5R-8h218VYEKWUHs-hBAQZIcpdlD5U-RUzbtxHiPLICTCUZ4mfIVyB96OXRgA9huwZAjHFT_QfKyfdGVC0RibEg2HhhLdNq9bIoow_KkRnyZG-IGaL1Z2cm_vSvPjw3FN3WwUQH1tl_MJtgNceDkdXxbCM4Ae_x5KY1ePdGOYMhBXHqzBAofp4f1NB01I7195Kua-qER_DKQ2dN14mhXPQ7z7jCPp5TC8EzGCJaMXRd5gjbOaKuRS8PGZdc0ZcZDHR3UJliEIhWeRhHjLAqRNFt8O4wfnVYPrm8MONBv3C9JoV1fIQXQjGr2JKJn6phwXGaZmM7gJKyxvhXU8kok9mGl7QVy9j2q_Vwts3wwCdCsRTF6JfoEBDJ48_RSh00lItFVg25cR-ZQZe4XVEgW--pMBlAW75Rz6VCydc1YkrefG63eI2gwrFtN2JFQohO77m6MLcLEEKsaMzDEslOpY1QlwYcd28DpKTR1NIEUDgRAxCpWhhXFCmiR-IMtVkFjwHx9-lvewUtwQ3-zpEMDcBB9riotZyG2839o1OPmhlWBLRWgqcRjGL3g5n1ABcC6v5RvjgnT-BcvNfg6wK_UzJAk6xjkPYlIfC4X-Mcfv7899N5T4gDaWkMAHVU7Y2GvWEx4y1YTp6JM3Y4vuyY4aDoMIjSbE4DKv_WNf9CM9TshaSfM8yU38KOF12DGCvCx3Ea_NM0EQSvX2qIuC3jD74p3RtjYhP1wm4CRhPNM0toMgtScA5wPUilGC40IQnP9Kp0L5xEWAKk-3gxbsXE25c3gbck4bsSAmVALG2WN6eyET4x1F-oignxj4AT4UKhAyIEwsyc4kRp1T-av4l_B7pAUZ9QG6r67ME3XrNypkTcIF4Xnoo_EG6D6VPco4DTTpmkFYE8cZiX2Y97vzxmA2e7iHXXPXLT6SrR8_VdmR0hfnKhp8i4iGji5Nf1p4GtFiQ3Hm35mfG0qMMI5O9Q76kMMwjzXiGUbioYjefw3YhuqPbq9_btAnZ8FyGGsc0Sf0TGSBX55dbrTfBs-KkCNR0tS_eVlSAURHpspRDzFPGDURgnNICt2pzhX3rqORKbcja4ChjME5U4zw4B53ZtAButGMQ4wyyAlpHdWlRk-mlM7rCDlIj5AX9X2AgBGmbnlCKhJ19ZAz8l0_d85VB0j-kPcU9GJAnMv_rOMrORqx_I1VImo8lAKvs3FEYFBqTwS7RPcfurJICMxdfTTPVW7XsYplV0JCdfBvrpYUUhdLTFH7Gbp8VW6E1az-dzs9s7yalVVnB6rychkEb-JkMLSqrVRpIa9KS0ihs7fFVzYDNYEr33igio4qjHvXW94o7MsOzi-9GD2Xu6DBHeHcQPJDL7w8urnM45m7UAASrqxhDtf6wBpp0s1RXSBn--s9PEAzH95HmIor-e6IffAncinTroUjk8xoS5huvaZ9AMc0JaUWJNUjeFf1HQ40oXUaHwKmmBiQqq3Tf6wIw_lFwpahiRDqyUYQXcF-JqhcNzpyq05M7-Ju0EFsi3i6kwLFLawkhl9wToK6etSTyk7odFWjYJTFvXz33ageoo5fwpTuye2mpmFZx35_a7hy6SYWnz4ElvHa9xtOkgzHmop1TMDvfPDT7geCeVYiLAnkg61IKzKEmtEJijFG_uDFKP7OE4ZXo4Oxwq3KTOqv8ElrNdwkMWm_qlMeDXK8bexd3L6Ds69MepxP2Y9vkuEogdr9K5Ty5KPRggcqQQwmQ4uFNGFdz18EpODyiQ32oYtfh1Q5uhtOQyDg-kzWLYdBVxmbfHTrA600MKbOGJ2ZebOcZ8Uv-Zom-u8EAd02mZ3iRJEmexAVN10p19-IAwAFWZCvrtddnck47NPQE3C0GOnm9KaexsOT_uz9jKF9YqqW6FWjkvPW_zIaxI1Oc-bGkIBOgc7myzaTWt8SAdEO51bKoWmMYQSSF5-udVwVQTH0-G5kfqXVsOeT2IJ8v09fhWGY76NK3qQtMUt9uot0uAROEiYCFGyWngHxtiqX9zyGaotplTyBVPa_u2qeDMJUC7ivTzfP7rUxnc0A_KeTJNWITb_MdQCsRiiPClcupE223Sav-nmivLSX95iwZEA7nzP0NGF20Thj4yugHDfHz90YF6GPNVfcnUlq83IajmXt_jUg52FtysY6aAMz2B_vV05uaErDJ6pNUUKY1NkP2F3cUnkHSWJfrS0aMG4ByR1R7fI6Tcs-S3589XNgRDVIPKVUBorVGhWPUvP7zdB0-3RzOGm50btUO8zOTfMxsFT_zRos4BTpsPl1p1sHfIEd65S5yZPMS4RtCkv3lyg0VMMc2wQy9ziIY3WeVxHZWvtGeUpL4xJmuwaHFXp_wTrvL_9WVjIvqsAANltJQn2-L-Wzfsnn4qEWBaEFuP4wkVxCSqqPJWYAOthjVtbACDoOdfSxebDsHEKR155YpTc4cLqv38KK8U8Z92Yk_12ANi4s3ryWSwhy_9yFQXkAQFMOlypIQ7DKTYn-gKNIk-V9m40f9v8AzFvTSfcYTTs2IgV0AtTWul3leyP_dGg_TFtuEp_JSxuElIwpsVay3fuBp9ot4gvgDeqkWNC9-8IoAOOh7037g54mxeLExzUEp9NGGa4UsGc2-6KTLEqFQOI_p0SxvDTWuxB9xRDoQIZHeDcUnaaYKsAUxyplXR72076WHS0Xx4omIp5vybxNRdpiIa6mgV8F4PMvdAvmkJLeOo8GmlHEqgWNZjLuAqUkwakA_JCT8qW_sqjf1YIODfkvDKRsaWBA26Ky7DpoSlu-bVvbXOHukyDPBTMYz9UZ8OTztRhk3TSXrwUQssl-As-LfrN5Pn88t_2FdjVUwYomgu3it2vrSMLxWrww9Tuy1RGIy1z3ooEfUzeinBE2nBrGF7W4nn7eBJMJwf_wRYkqRbHLVDFnVbUO7XT5okH7uEZ36YXfuVWO8azbnTndtHG9-mQIGhxN0HfXvtrTCUmIPF2W7l4b7RAslfpSyDcYCrTtUV7ZV-WlLYiOuHNQFJREDl7ceCL0m9Sxui24_hUd_-LK7uXwUYY7Kpr44V-p28JQVgxjaHgjJj3ebPWuR46WHCHDjmH0ecyUxNA74d4R7Ompye_GgdUZwck46M1fsrjiC0mFVg4KHTpDM6evgALW8Wj6E__I2h2Zf2iK8NmLQN78y9t5Pmf1cDcAYhhRXwWm-j_ECpnqQL7G8DNdqCaCZhy6NZWlFZiG32qlEvOIpj5Zno7PsAVnfHVLMYPwKACb5neQD3Dji6r129JDdqYttKV2TPbtYGhRi8xzfInsdklaXNBIhYkigmtu1B7GKU7FdDaDAy&cid=CAQSOwDZpuyz5xpm30cC9VooE9G3YG6gm_SWfgwxYTjdMVuwwsUTo9Wvow6CZS92g0v_CZ5FbTkwvlr-Z6AXGAE&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=14546998538469800000&adk=1033480540&idt=797&cac=0&dtd=82

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e4ab2fd00ce810ecb40c329fc74eabf3131ebb8adddf2cf44e6ce2357180136

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 13617926490653145715
age: 13953
x-content-type-options: nosniff
expires: Thu, 05 Jun 2025 19:59:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 22 May 2025 19:59:38 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10882
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 931C 41 KB
14 KB 130ms
127ms Script
text/javascript 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2000
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Fri, 23 May 2025 00:08:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:18:51 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0Nzk1NzkzMTEyNzc4MwogIHNlcnZlcl9pcDogMTQxMDQ2NzIwCiAgcHJvY2Vzc19pZDogNDE5NjEyNzc4NAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA1Mjk3MTA2...
ad.doubleclick.net/ddm/activity/ Frame 931C 0
22 B 265ms
137ms Image
image/png 142.251.167.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0Nzk1NzkzMTEyNzc4MwogIHNlcnZlcl9pcDogMTQxMDQ2NzIwCiAgcHJvY2Vzc19pZDogNDE5NjEyNzc4NAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA1Mjk3MTA2CmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9tZWxpYS5jb20iCnhmYV9hdHRyaWJ1dGlvbl9pbnRlcmFjdGlvbl90eXBlOiBWSUVXCmltcHJlc3Npb25fcHJpb3JpdHk6IDAKaW1wcmVzc2lvbl9leHBpcnlfaW5fZGF5czogMzAKZXZlbnRfaW1wcmVzc2lvbl9pZDogMTY0NzkzMTQ2MTMzNTY2NzU3MzMKZGVidWdfa2V5OiAxMzYwMDc2MzQyNjU3NjI5NjY2OQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjUtMDUtMjIiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1Mjk3MTA2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQyMTU4NzMwNgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT09LSUVfQ09OU0VOVAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNzE4NTA4MDUzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIyNTIzNTY3OTYyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNjU4MDUyMTgzCiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKZmxvb2RsaWdodF9hY3Rpdml0aWVzX2Zvcl9iaWRkaW5nOiA5MzEwMzk5CmZsb29kbGlnaHRfYWN0aXZpdGllc19mb3JfYmlkZGluZzogMTQ1NTQ2NjE3CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9tZWxpYS5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3ODA0NzYwODgzMgpkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3CnhmYV9hdHRyaWJ1dGlvbl9hcGlfdHlwZTogWEZBX0FUVFJJQlVUSU9OX0FQSV9UWVBFX1dFQgplY2hvX3NlcnZlcl9hY3Rpb246IEVDSE9fU0VSVkVSX0FDVElPTl9VU0VfQkVTVF9BVkFJTEFCTEVfQVJBCmV2ZW50X3JlcG9ydGluZ193aW5kb3dzIHsKICBlbmRfdGltZXNfc2Vjb25kczogODY0MDAKICBlbmRfdGltZXNfc2Vjb25kczogMzQ1NjAwCn0KbWF4X2V2ZW50X2xldmVsX3JlcG9ydHM6IDIK

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f148.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x6004e9d823023d800000000000000000","13":"0x2fc9694cffd087620000000000000000","14":"0xda04f0a45ebbff6b0000000000000000","15":"0x836ea7e7e466c8d90000000000000000"},"debug_key":"13600763426576296669","debug_reporting":true,"destination":["https://melia.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["9310399","145546617"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5297106"]},"max_event_level_reports":2,"priority":"0","source_event_id":"16479314613356675733"}
content-type: image/png
server: cafe

GET
H2 200 bootstrap.js Show response
s2.adform.net/mink/634/s2.adform.net/ Frame 931C 38 KB
17 KB 388ms
129ms Script
text/javascript 185.167.164.45
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL: https://s2.adform.net/mink/634/s2.adform.net/bootstrap.js
Requested by: Host: a1.adform.net
URL: https://a1.adform.net/adfscript/?bn=80646549;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CwPLWqbgvaNqFEdGOqMwPjZfhoAfY68-Hf5nTt6CpFPnWl7_wChABIPub1UlgyZ72hoCAoBmgAZjUmaoByAEJqQL3qIYECuyyPqgDAcgDmwSqBOsBT9DF3eiv0_4dlA-2Td8U38rFqL4VdMm0uHuVzORho8u5MP8x6IAWnuaDAzmxZrFpIA90rAJQR_-RkzyH2Rebk-5NIt_kmXIll9_3cn29lFCKTPz-AX5nR_VhGtuyPqD_uZ5WR0T7zD0Xvv1ptGF5RBxF2SZCWzUvuc54n41q64F3dgvpVaYx4D1Y8pL0xPlBjRZc7_OlinZ5IXhoihu9KD9CvyCudRYW4LekLGs1WneqX3O3p29xvtfI1p_KraOBgpeaDAQueDn3dsSSuvawynMY_nc1U1L_ryC65lfgMmHjl3vq6WLHBYl6IcAE966_mqkF4AQDiAXavon0U5AGAaAGTYAH0Kvm1QKoB9XJG6gH2baxAqgHtrmxAqgHpr4bqAfz0RuoB5bYG6gHqpuxAqgH4L2xAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgHmgaoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwDSCCkIgGEQARidATICigI6DYBAgMCAgICAqIACoANIvf3BOli5u9HboriNA4AKA5gLAcgLAYAMAaIMCCoGCgTaz7ECqg0CVVPiDRMIxunR26K4jQMVUQeKAx2NSxh06g0TCPK40tuiuI0DFVEHigMdjUsYdPANAbATqIDQHNgTCtgUAdAVAfgWAYAXAbIXqgEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAwQgUIhY_4L-gXBLIYCRICkVQYTSIBAA&ae=1&num=1&cid=CAQSOwDZpuyz5xpm30cC9VooE9G3YG6gm_SWfgwxYTjdMVuwwsUTo9Wvow6CZS92g0v_CZ5FbTkwvlr-Z6AXGAE&sig=AOD64_0SkjHRAlmR6wZutJTKEFsmiKyJ1A&client=ca-pub-5812357352335075&dbm_c=AKAmf-BreyqrCusBtrffzMX6It6UEX0wd3qR7zOdJQdSNgniHnd7z-0ES8VvnxmoXUlvWmR4aQGvRODikna7Mtc490th1vh7r_7-elKQtPFYFu_qK7wkeaTyeecxLEC26SfqeJc-z4jvpqWIOXhwJiAO2S7iEkayHCDDiv4LU_bGwoAT4GgFfI5AT8AQEFJpbYUVc_8_mlY_2LHcf7_IwrWoD5rNLtKuZ-rEsPH023GaOloIYIStRYHHUVm6rGBvpeNhy_41gknN9Ozu2VlQx83gOmVhl6_Owg&cry=1&dbm_d=AKAmf-BTNyq35T4zHxflNWQVbxbDK4BPd77fSkZ1sWiLoNPfV3Nn6yTDOLCZSJnehQO3XSnkfmp_4iWJVtemdozqsRKhV2NJWAux9v_iiUZyJ6ABTdbNCwZPdzHmdxWl2DNoJZ2J4sS_-401A_yI1mxVWxTMuSFERmBz5inxi6AeEh3Jkl22c1-o8X8dJzbSYHPg9MpQct4E__B_AaRRuwy4YoKchtcy_kTpq74gbOU-2LCpw16_NVBLc1kU-13HfN4BJqjxT9gKO4L2vueeQqHEZJpFvRc-iVDZNJo2sqdfjofIFGFqs8vjztZf7ZvSo0e809bSPsLywBxWDgMGD3hYqEet-IafCv6JAwlXlzyCb4G-VfQnurLYK0z0VgIwbOkVMUzgSLbF75HfT3Xw970DQLg5ZZm5gAHk0MUGsrrkYH5yTwOnP7jbX7EUVMkOTq0eZnYKkeL0P9Y2oOz4QEi4PULDb4Q1LkTgKwzVI6lGq7PlHoLrN3q_Yj3J8AMdgApGrG_0d5ftfgjOmjBBK7WqARCo74x33pGqBPIQ8nJH0j7vBEKBVi4Tp3thEi3SOfL8gVe99ekuwWkhcf5dUa9FOyzK0UCSJ74ZOR8m5WRWj8Fv-cLt_HggKsuYW4Z_5em_J3t4VzA6qDXFM9FrxcdDEciDyGLndLmkH_DRKCguTvcB-qzUpKE&adurl=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.167.164.45 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software: nginx /
Resource Hash: 0681c1955fe06b7a22f5339cddfc277b97acadf434b679973543e718bdb0b5d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

x-cache-status: HIT, STALE, STALE
cache-control: public, max-age=100000
content-encoding: gzip
expires: Wed, 22 Jan 2025 19:03:05 GMT
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/javascript
vary: Accept-Encoding
server: nginx
last-modified: Thu, 31 Oct 2024 12:44:10 GMT

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame 5CDD
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=8584365486650651073

0
370 B

121ms
121ms

Image
text/plain

104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=8584365486650651073
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=ebbd919a-032f-487b-80d9-c597be53c105&33across.com=v1.0014000001YrMoYAAV.1042.xI8+869tPnrYC6fcfheTCNrTKs+t50jy+qf3z0PXWh65Lw5IHMn+rSx4u7WVfiVquSNgXCDlrKNV+QZFmqX3ZorQ0jK6ZuxSBz0Yr/3T85ycJ+pW72qkZltXO5I5tMJci6lfR5peJz/K3h1LYQkAzEC6DavQBGm1X9cu5tqVHjwW+EkTN03gGe3Cadxu3tX0PXn3F6dYvC0MaGbl3WO4Cpg3U5fjdqcdn/hx6f97Og8f/VRnJCGg9yx1CIFNgTInJrHUAiwVn0loiCEHHwZ8+mvO6hc6E5/KxV84TiB4u8EjimCNKws45PayxshnYXHyX+YP2Tr1J2jsjFihPEg2EC/xy/cAStNrT7iREItV606zjFRsQtY4tg+xFMCaEWdwTR2F2xade8Fe7fHLVWSjEBRuTULeqz2uj6QG6/aWi6PbbvQJgi7mD6GZdlxG39x1oyMjm2bvqjrY3l3tpjuuPIC/DagfbVClU68OSlLlr6qGhQDb26CyXVrZk5bKZLtgfNrnQpI9vPmk6s6k2GBd1TMKENkM6Iy4WF+UNnPNFHoph/uMSvIxqzsrC9tdBbGtsrGJfXMIkehdQKKJKkZkfNeaNpJpNXvKEDzSE3RWspH6Z37AjppjKwc6p1NpIxSRCZF3A58ZXF60P/iQNlh36CDE47MbuhoL/XXGEH7nX/Rtwtgi7nVUpH5NqrgAPToAHFGDRoCgTpAnMCLC9rlMBDCTEVBg7JaGVd/CuG63BP2AtBZpjcdWEAOWk2CWcgRRuCHY1qFeDgEk6MTX/5aSJWeWBJ7YJkSw8jW/oaHghFXi9g+XLsFSH30J7jqTDsRLWYCcYapuaNNBqKtX7Q163Gw3pwU/CJI+wASrw3eljWdu5Y0RnAdxDQSb0WBFixt8KAxxQtGM5Ui1c/5l//qK0zPj4Gc2wZdaRpptfI9yDNyHLwQ9uFdWKR08JkdlxuXTYMSajVFZup+Onhp4r2mhMQ0SLZtJKm4lQ4aTLlwZ8TMhmmpZJXTvFw9DWM2+XZ0L7P0Fe/M+Vdph+0c1KI0Rn7rBX6q9zexP703+43cJNWwGZzG49OSS24E0C2O0/jWL/mE0Qxnrcjj0V6kE0UeI+JU13Doe0TvSdliVTOhQnBuUJQjYL0tbdwCdVzXRzfEaPYyuP4cNmVaJZRmD/bU/gxPcZ/vW5FPJHrTQT0zTQX4ZcwUTX/NPy0UI7YTR3/GaNh8Czqy2sn/llu0OCkMY+eIdVBGWi98jl9g0oxiHOZBoQwz3YexvA1DPWRmn7WTT2Ro8HU6I3MYtp++7IKUJ45crnDqIHwLlcPBEaz73gvJ3anvSED+YR+jcl+4XrR5AMXTKfb53QRkFYdfsTgzVighku3b/2LHX9yK3kTQt5vagK9npvja/ZiTSTu+Dja5vy0WGfoiCtTYj0GLXl1CAjLWFCBIeYTquUg9tSSovyDMA7TMK6fQ99rvaAjMdiKfdiHEWzQhlMSqz6pUgxqAT2Tutf6/a0Gc/vadCwwqL8UyVtuw/LCH0nXaBBNSLIbgm&linkedin.com=8aca5632-0203-4aa4-9037-f34359733f80&publisherId=OZONEPLA0001&siteId=3500001145&cb=1747957928425&bidder=ozone
Protocol: H2
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 944039d4481f7c85-LAX
expires: 0
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=8584365486650651073
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 23:52:11 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame BD02 38 KB
13 KB 123ms
122ms Document
text/html 2607:f8b0:4004:c17::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1799
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 23:22:12 GMT
expires: Fri, 23 May 2025 00:12:12 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js Show response
pagead2.googlesyndication.com/bg/ Frame BD02 54 KB
21 KB 125ms
124ms Script
text/javascript 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Wb8bPZigRvc_GFKs9artHwCAEk0Ifr6vx8-xXlqx1qs.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59bf1b3d98a046f73f1852acf5aaed1f0080124d087ebeafc7cfb15e5ab1d6ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 128527
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 21 May 2026 12:10:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 21 May 2025 12:10:04 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21184
x-xss-protection: 0
server: sffe

GET
H2 200 / Show response
a1.adform.net/adfserve/ Frame 931C 11 KB
5 KB 130ms
129ms Script
text/javascript 185.167.164.53
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://a1.adform.net/adfserve/?CC=1&bn=80646549;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CwPLWqbgvaNqFEdGOqMwPjZfhoAfY68-Hf5nTt6CpFPnWl7_wChABIPub1UlgyZ72hoCAoBmgAZjUmaoByAEJqQL3qIYECuyyPqgDAcgDmwSqBOsBT9DF3eiv0_4dlA-2Td8U38rFqL4VdMm0uHuVzORho8u5MP8x6IAWnuaDAzmxZrFpIA90rAJQR_-RkzyH2Rebk-5NIt_kmXIll9_3cn29lFCKTPz-AX5nR_VhGtuyPqD_uZ5WR0T7zD0Xvv1ptGF5RBxF2SZCWzUvuc54n41q64F3dgvpVaYx4D1Y8pL0xPlBjRZc7_OlinZ5IXhoihu9KD9CvyCudRYW4LekLGs1WneqX3O3p29xvtfI1p_KraOBgpeaDAQueDn3dsSSuvawynMY_nc1U1L_ryC65lfgMmHjl3vq6WLHBYl6IcAE966_mqkF4AQDiAXavon0U5AGAaAGTYAH0Kvm1QKoB9XJG6gH2baxAqgHtrmxAqgHpr4bqAfz0RuoB5bYG6gHqpuxAqgH4L2xAqgHjs4bqAeT2BuoB_DgG6gH7paxAqgH_p6xAqgHr76xAqgHmgaoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwDSCCkIgGEQARidATICigI6DYBAgMCAgICAqIACoANIvf3BOli5u9HboriNA4AKA5gLAcgLAYAMAaIMCCoGCgTaz7ECqg0CVVPiDRMIxunR26K4jQMVUQeKAx2NSxh06g0TCPK40tuiuI0DFVEHigMdjUsYdPANAbATqIDQHNgTCtgUAdAVAfgWAYAXAbIXqgEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAwQgUIhY_4L-gXBLIYCRICkVQYTSIBAA&ae=1&num=1&cid=CAQSOwDZpuyz5xpm30cC9VooE9G3YG6gm_SWfgwxYTjdMVuwwsUTo9Wvow6CZS92g0v_CZ5FbTkwvlr-Z6AXGAE&sig=AOD64_0SkjHRAlmR6wZutJTKEFsmiKyJ1A&client=ca-pub-5812357352335075&dbm_c=AKAmf-BreyqrCusBtrffzMX6It6UEX0wd3qR7zOdJQdSNgniHnd7z-0ES8VvnxmoXUlvWmR4aQGvRODikna7Mtc490th1vh7r_7-elKQtPFYFu_qK7wkeaTyeecxLEC26SfqeJc-z4jvpqWIOXhwJiAO2S7iEkayHCDDiv4LU_bGwoAT4GgFfI5AT8AQEFJpbYUVc_8_mlY_2LHcf7_IwrWoD5rNLtKuZ-rEsPH023GaOloIYIStRYHHUVm6rGBvpeNhy_41gknN9Ozu2VlQx83gOmVhl6_Owg&cry=1&dbm_d=AKAmf-BTNyq35T4zHxflNWQVbxbDK4BPd77fSkZ1sWiLoNPfV3Nn6yTDOLCZSJnehQO3XSnkfmp_4iWJVtemdozqsRKhV2NJWAux9v_iiUZyJ6ABTdbNCwZPdzHmdxWl2DNoJZ2J4sS_-401A_yI1mxVWxTMuSFERmBz5inxi6AeEh3Jkl22c1-o8X8dJzbSYHPg9MpQct4E__B_AaRRuwy4YoKchtcy_kTpq74gbOU-2LCpw16_NVBLc1kU-13HfN4BJqjxT9gKO4L2vueeQqHEZJpFvRc-iVDZNJo2sqdfjofIFGFqs8vjztZf7ZvSo0e809bSPsLywBxWDgMGD3hYqEet-IafCv6JAwlXlzyCb4G-VfQnurLYK0z0VgIwbOkVMUzgSLbF75HfT3Xw970DQLg5ZZm5gAHk0MUGsrrkYH5yTwOnP7jbX7EUVMkOTq0eZnYKkeL0P9Y2oOz4QEi4PULDb4Q1LkTgKwzVI6lGq7PlHoLrN3q_Yj3J8AMdgApGrG_0d5ftfgjOmjBBK7WqARCo74x33pGqBPIQ8nJH0j7vBEKBVi4Tp3thEi3SOfL8gVe99ekuwWkhcf5dUa9FOyzK0UCSJ74ZOR8m5WRWj8Fv-cLt_HggKsuYW4Z_5em_J3t4VzA6qDXFM9FrxcdDEciDyGLndLmkH_DRKCguTvcB-qzUpKE&adurl=;json=1;js=1;adfxid=1x;2949;set=en-US|en-US|1600X1200||150|600|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;cmpgpp=;cmpgpp_sid=;fd=0|0&CREFURL=https%3A%2F%2Fpaint.toys

Requested by

Host: s2.adform.net
URL: https://s2.adform.net/mink/634/s2.adform.net/bootstrap.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

3ddac1839046888318c3d80bbc4398eee364b15463d3916091b39073f886769e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
access-control-allow-methods: GET,POST
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store, must-revalidate, no-transform
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-origin: *
server: nginx

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 9EE8 4 KB
5 KB 132ms
131ms Document
text/html 67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 2a2a92c7d70f3791b7bea646b6d67ffb04414962adbb59a106ff38c5144fbb91

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4157
content-type: text/html
date: Thu, 22 May 2025 23:52:11 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1 200
OK 1x1.b
mml1.melia.com/dynview/melia-com/ Frame 931C 111 B
1 KB 612ms
207ms Image
image/png 109.232.197.110
EULERIAN-AS EULER...

General

Check archive.org

Download Go to Show image

Full URL

https://mml1.melia.com/dynview/melia-com/1x1.b?ead-publisher=DV360&ead-name=AMERICA_US_AO_PRS_MR_DEST-SPAIN-VAC_DIS_DV360_ALL_DIS-EST_NA_NA&ead-location=DISPLAY_PROSPECTING_US-DIS_DIS-EST_EN&ead-creative=AMERICA_US_AO_PRS_MR_DEST-SPAIN-VAC_DIS_DV360_ALL_DIS-EST_NA_NA&ead-creativetype=DEST-SPAIN-VAC&eseg-name=AO&eseg-item=VAC&ead-mediaplan=US-Prospecting&ea-rnd=44709&adfrmid=8584365486650651073

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

109.232.197.110 , France, ASN50234 (EULERIAN-AS EULERIAN TECHNOLOGIES S.A.S., FR),

Reverse DNS

ml.eulerian.net

Software

EWS /

Resource Hash

0609b70c35eab974a2c2d99d6da5d84d95b97f9fe3d28828710d04835153cb20

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

Strict-Transport-Security: max-age=604800
X-Robots-Tag: noindex
Cache-Control: max-age=0, private
Pragma: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Connection: Close
X-Content-Type-Options: nosniff
Accept-Ranges: none
Content-Length: 111
Date: Thu, 22 May 2025 23:52:12 GMT
X-XSS-Protection: 0
Content-Type: image/png
Server: EWS

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4E4B 1 KB
643 B 124ms
123ms Document
text/html 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 40297
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 12:40:35 GMT
etag: 48472445140208031
expires: Fri, 23 May 2025 12:40:35 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 0
0 133ms
132ms Fetch
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 0
0 132ms
132ms Fetch
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 931C 210 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1023974db289fedd08742a199d99a5b6d8206e4cbed334060f9f0f0a9e7778a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 931C 0
0 135ms
135ms Fetch
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 setuid
prebid.intergient.com/ Frame 9EE8 0
1 KB 150ms
150ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=6908656d-8896-72e9-fb9c-72db54efcdc3
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1747957932&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fC5AByoy34DGg8JabkwqZ00N%2FJRb04CWSu5vukYsuM0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 22 May 2025 23:52:12 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1747957932&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=fC5AByoy34DGg8JabkwqZ00N%2FJRb04CWSu5vukYsuM0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944039d44d01b860-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=4044189102943046563&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=

43 B
496 B

297ms
296ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=4044189102943046563&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

cache-control: no-store, no-cache, private
location: https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=4044189102943046563&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 228ffea0-ce4b-47d4-baa1-404303aaf2f5
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9EE8
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=3c935905e5c30691&is_secure=true&networkId=17100&version=1&nuid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAAmm_dcM9ItQIeGiaOAQEBAQEBAQCX-2hkSAEBAQEBAQEB&expiration=1748044333&nuid=F9D9BDDC-D273-45...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=10f4f0d3-a6a8-40ab-88f0-76ce2a0d4417

42 B
97 B

119ms
118ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=10f4f0d3-a6a8-40ab-88f0-76ce2a0d4417
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 22 May 2025 23:52:14 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=10f4f0d3-a6a8-40ab-88f0-76ce2a0d4417
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Content-Length: 0
Date: Thu, 22 May 2025 23:52:14 GMT
Keep-Alive: timeout=1, max=497
Server: Apache
Connection: Keep-Alive

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

314ms
314ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=f87e7bfd-ee85-4af0-b2d2-53c8cf04358b&gdpr=&gdpr_consent=&us_privacy=1NNY
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 23:52:12 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY

43 B
496 B

195ms
195ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
date: Thu, 22 May 2025 23:52:12 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=393048094558715985324&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

313ms
312ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=393048094558715985324&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=393048094558715985324&gdpr=&gdpr_consent=&us_privacy=1NNY
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 22 May 2025 23:52:12 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KtMYALZH1noc2aSvTGmrfreT&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

130ms
129ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KtMYALZH1noc2aSvTGmrfreT&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:13 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KtMYALZH1noc2aSvTGmrfreT&gdpr=&gdpr_consent=&us_privacy=1NNY
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 23:52:13 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%2...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=5d480b64fac005d3&is_secure=true&networkId=17100&version=1&nuid=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADuyIUXHm8twJAeWoWAQEBAQEBAQCX-2hlyAEBAQEBAQEB&expiration=1748044333&nuid=F9D9BDDC-D273-45...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

133ms
129ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:13 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=F9D9BDDC-D273-4502-A8F9-A6056EF53565&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 178
date: Thu, 22 May 2025 23:52:13 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=11e6601f-4b1b-4da4-b48e-8893d3f91aa4

43 B
496 B

176ms
176ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=11e6601f-4b1b-4da4-b48e-8893d3f91aa4
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=11e6601f-4b1b-4da4-b48e-8893d3f91aa4
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-680e4fdf-1d6d-4f0a-906c-5d8c2a1884b0

43 B
496 B

134ms
133ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-680e4fdf-1d6d-4f0a-906c-5d8c2a1884b0
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
location: https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-680e4fdf-1d6d-4f0a-906c-5d8c2a1884b0
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=ac936eb47cd052145195642776fb562f&_fw_gdpr=&_fw_gdpr_consent=

43 B
496 B

130ms
129ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=ac936eb47cd052145195642776fb562f&_fw_gdpr=&_fw_gdpr_consent=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: no-cache
Location: https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=ac936eb47cd052145195642776fb562f&_fw_gdpr=&_fw_gdpr_consent=
Pragma: no-cache
x-sticky-vk: 1747957932645027-139
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 22 May 2025 23:52:12 GMT
Server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9EE8
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3909595322251504000V10&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

133ms
132ms

Image
image/avif

67.205.183.251
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3909595322251504000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 67.205.183.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 22 May 2025 23:52:12 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3909595322251504000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 22 May 2025 23:52:12 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 22 May 2025 23:52:12 GMT
Content-Type: text/html
Server: Apache

GET
H2 200 Standard Show response
s2.adform.net/mink/634/s2.adform.net/load/v/0.0.254/e/igSBgiDS/i/uEAv-wgAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 931C 96 KB
41 KB 166ms
166ms Script
text/javascript 185.167.164.45
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL: https://s2.adform.net/mink/634/s2.adform.net/load/v/0.0.254/e/igSBgiDS/i/uEAv-wgAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s2.adform.net
URL: https://s2.adform.net/mink/634/s2.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.167.164.45 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software: nginx /
Resource Hash: b405402714aae10cbb124b52449f4ecb2b155b3b76b683b7934a5c49a246a834

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/

Response headers

x-cache-status: EXPIRED, STALE, STALE
cache-control: public, max-age=100000
content-encoding: gzip
expires: Wed, 22 Jan 2025 19:12:55 GMT
access-control-allow-origin: *
date: Thu, 22 May 2025 23:52:12 GMT
content-type: text/javascript
vary: Accept-Encoding
server: nginx
last-modified: Thu, 31 Oct 2024 12:44:10 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame F630
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

127ms
127ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 23:52:12 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame BA27 958 B
1 KB 88ms
87ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 5536a45cb9e48d6a347580d101c8045a6e2806daa78f6df865680217cf231c0b

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 958
content-type: text/html
date: Thu, 22 May 2025 23:52:11 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H3 200 cm Show response
us-u.openx.net/w/1.0/ Frame 6E96 960 B
980 B 88ms
88ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: fd48b71950475aa69d5421eca3b598987437299f946b43503e7edba020099e28

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 960
content-type: text/html
date: Thu, 22 May 2025 23:52:11 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 6F42
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

125ms
124ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 22 May 2025 23:52:12 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BD02 0
20 B 138ms
137ms Image
image/gif 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BTWamq7gvaKfmB8DnoPMPqKjv0A8AAAAAOAHgBAI&bg=!rK-lr-DNAAYA59AtIOc7ADQBe5WfONKL4xha2JEHEsNTVfkRpRTIu83bmAsj7hVnT8-ye2wRgFrmVw-TnEpBvjSr3yULAgAAAQRSAAAABmgBB34ANUJ5MXm5M5GGPf4uxoNYrTjywP8bQNh4xkvxFtrtK_RQftbPtoSvXC0m_WSGReImguoXHg1YmQKlTjHTB5jGVz9ca4rKxtatElre9vGTkGnKRHr-OSJvtnbUzUeKyUH0QQ0ivjK8TG-JM79ZHPey2vMfOH-w5Kq6mdzyaJ3XSpUCzgDNcaQLbvFGhrGea5kFF8JMZRf7a7X-WWsAOMKb4BrrMKyY4FZNdMoaguOMc0OvHqB2XmsNV0YBBoyNQvxq60zsWgSl8JINd4CdP-2qtyItpVkStHS6PBt4AUZ4j68pLaUTnPu3BpbgURE-BQJfn0skFjSBR7SROTFMFn7UGOm3dFubJ4xReo49BaOD0pa5nJjG4-Adj-IqC7mRHnyJ9P47fOaHxscqprIdRzE3eNUw8GOIk0q9UCDs9rp8LF85RH_n2fcxYS8hknerkzIVcFLPxQk4DsTQjD5wV48IFP2JtyVGcjp9dwr_sqs_he9ow9SYTQrnk24YR-z3nNNwfARZZbFRDkW5GF3N4e6CLqChI5Y9FD43kq648TsPwY3c436iDwWrKJaDl2vQTv8iAwiCSpnnd_N_UzpR0S9WM3Xpz5FrFopw0VJM9VXqGsVClow369KRAR3WacKlYVhaViI775mqFjFS3I4UmV0k-bRUSMjw8PLXS3c_ISDDDmbu4aDV8uRoFX-aL54B__B9f8CU09EgSCOuhASjIS4aYPTNbYJXCClMXzT5PGoiUCHjGSjPbFdNE84lVj3DDelncSRJQ5x6NEOqIgE6Wl5jHThLr7StZuYXSRnX4w-E9BhATAheM1-prrQIGVnLL339djbHTRcDt47HfcfP6KwdvJXsVpjb82Jhs2JE0G6q9KSfMQRelAlucZtYjF0OIrBt0DMbI8usjPUslW3lE0wvR7Iq8p4Yk8yiyvSanyt8gEohTIYl76YjEVJD1fHIEwyEFkt7womVXAzKa6eYpac

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_push=AXcoOmTnyfdOvKIYVJzwsKYFgSq5ZDkMWDJ8IafvKxYMvl8RWtGrdx5JdUzKb0hmeVZjFYPRa5OCez1Tx99BP6xTKiBKGSh9pVw
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=307b25aa44b70742&is_secure=true&networkId=14000&version=1&google_push=AXcoOmTnyfdOvKIYVJzwsKYFgSq5ZDkMWDJ8IafvKxYMvl8RWtGrdx5JdUzKb0hme...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQADb3fZotKfxAJnn2Y7AQEBAQEBAQCX-2hiagEBAQEBAQEB&expiration=1748044332&is_secure=true&google_push=AXcoOmTnyfdOvKIYV...

170 B
188 B

135ms
135ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQADb3fZotKfxAJnn2Y7AQEBAQEBAQCX-2hiagEBAQEBAQEB&expiration=1748044332&is_secure=true&google_push=AXcoOmTnyfdOvKIYVJzwsKYFgSq5ZDkMWDJ8IafvKxYMvl8RWtGrdx5JdUzKb0hmeVZjFYPRa5OCez1Tx99BP6xTKiBKGSh9pVw

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQADb3fZotKfxAJnn2Y7AQEBAQEBAQCX-2hiagEBAQEBAQEB&expiration=1748044332&is_secure=true&google_push=AXcoOmTnyfdOvKIYVJzwsKYFgSq5ZDkMWDJ8IafvKxYMvl8RWtGrdx5JdUzKb0hmeVZjFYPRa5OCez1Tx99BP6xTKiBKGSh9pVw
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
pragma: no-cache
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmQvm3FRmGn4qNCU27jagMgeXXyMhbU23eoLSOu7rtYtvtg5TvpCx5_zxA8jSI_aaUTsuKprZJAXaC...
https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQvm3FRmGn4qNCU27jagMgeXXyMhbU23eoLSOu7rtYtvtg5TvpCx5_zxA8jSI_aaUTsuKprZJAXaChhg_02VQ285psmlQ3L&google_hm=MTcyYWFiYzUtYTZkNC00Z...

170 B
188 B

135ms
134ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQvm3FRmGn4qNCU27jagMgeXXyMhbU23eoLSOu7rtYtvtg5TvpCx5_zxA8jSI_aaUTsuKprZJAXaChhg_02VQ285psmlQ3L&google_hm=MTcyYWFiYzUtYTZkNC00ZmIxLWE3YmMtYzkxZWYxYTJlNDIz

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, private
location: https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmQvm3FRmGn4qNCU27jagMgeXXyMhbU23eoLSOu7rtYtvtg5TvpCx5_zxA8jSI_aaUTsuKprZJAXaChhg_02VQ285psmlQ3L&google_hm=MTcyYWFiYzUtYTZkNC00ZmIxLWE3YmMtYzkxZWYxYTJlNDIz
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 23:52:13 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-172
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://match.360yield.com/match/ebda?google_push=AXcoOmTtKClw2g__rYnA-hpSqz6j2acJObuNTLgbRfDOugAl1kEmKU3p5tjfDunLbkDX24GAKId7n7dZ7ViAlWg87fmpRiimeEkJ
https://match.360yield.com/ul_cb/match/ebda?google_push=AXcoOmTtKClw2g__rYnA-hpSqz6j2acJObuNTLgbRfDOugAl1kEmKU3p5tjfDunLbkDX24GAKId7n7dZ7ViAlWg87fmpRiimeEkJ
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=cL1F9ElEQu-8isnfcyTO7Q&google_push=AXcoOmTtKClw2g__rYnA-hpSqz6j2acJObuNTLgbRfDOugAl1kEmKU3p5tjfDunLbkDX24GAKId7n7dZ7ViAlWg...

170 B
188 B

133ms
133ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=cL1F9ElEQu-8isnfcyTO7Q&google_push=AXcoOmTtKClw2g__rYnA-hpSqz6j2acJObuNTLgbRfDOugAl1kEmKU3p5tjfDunLbkDX24GAKId7n7dZ7ViAlWg87fmpRiimeEkJ

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=cL1F9ElEQu-8isnfcyTO7Q&google_push=AXcoOmTtKClw2g__rYnA-hpSqz6j2acJObuNTLgbRfDOugAl1kEmKU3p5tjfDunLbkDX24GAKId7n7dZ7ViAlWg87fmpRiimeEkJ
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 22 May 2025 23:52:12 GMT
content-type: text/plain

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://cs.media.net/cksync?type=g&google_push=AXcoOmQF1PgOEywJHXlPM0GSJII_kOpwfQ5G8l4My7wXjNMFPcpRZGVcRrJlYg4_72zm_tW3zCX3t1Ha7lliSMItXgZZITGd65RU
https://cm.g.doubleclick.net/pixel?google_hm=MzkwOTU5NTMyMjI1MTI5MTAwMFYxMA%3D%3D&google_nid=media&google_push=AXcoOmQF1PgOEywJHXlPM0GSJII_kOpwfQ5G8l4My7wXjNMFPcpRZGVcRrJlYg4_72zm_tW3zCX3t1Ha7lliSM...

170 B
188 B

135ms
135ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=MzkwOTU5NTMyMjI1MTI5MTAwMFYxMA%3D%3D&google_nid=media&google_push=AXcoOmQF1PgOEywJHXlPM0GSJII_kOpwfQ5G8l4My7wXjNMFPcpRZGVcRrJlYg4_72zm_tW3zCX3t1Ha7lliSMItXgZZITGd65RU&google_sc=1&mn_hm=MzkwOTU5NTMyMjI1MTI5MTAwMFYxMA%3D%3D&gdpr=&gdpr_consent=

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://cm.g.doubleclick.net/pixel?google_hm=MzkwOTU5NTMyMjI1MTI5MTAwMFYxMA%3D%3D&google_nid=media&google_push=AXcoOmQF1PgOEywJHXlPM0GSJII_kOpwfQ5G8l4My7wXjNMFPcpRZGVcRrJlYg4_72zm_tW3zCX3t1Ha7lliSMItXgZZITGd65RU&google_sc=1&mn_hm=MzkwOTU5NTMyMjI1MTI5MTAwMFYxMA%3D%3D&gdpr=&gdpr_consent=
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 22 May 2025 23:52:12 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 22 May 2025 23:52:12 GMT
Content-Type: text/html
Server: Apache

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_push=AXcoOmRYOh90CIOPSaJx2re4lwkvZuYjk9xGLXj_RyhQ8Ufud5PzkANbz6rmnlg7MFBNR4tViYC0imeiKyhEjEnKmSO1ILrL3UMDlA
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRYOh90CIOPSaJx2re4lwkvZuYjk9xGLXj_RyhQ8Ufud5PzkANbz6rmnlg7MFBNR4tViYC0imeiKyhEjEnKmSO1ILrL3UMDlA&google_hm=f...

170 B
188 B

134ms
133ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRYOh90CIOPSaJx2re4lwkvZuYjk9xGLXj_RyhQ8Ufud5PzkANbz6rmnlg7MFBNR4tViYC0imeiKyhEjEnKmSO1ILrL3UMDlA&google_hm=fKrhdkbqQvu8fCBjjsXmUfQ

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRYOh90CIOPSaJx2re4lwkvZuYjk9xGLXj_RyhQ8Ufud5PzkANbz6rmnlg7MFBNR4tViYC0imeiKyhEjEnKmSO1ILrL3UMDlA&google_hm=fKrhdkbqQvu8fCBjjsXmUfQ
pragma: no-cache
via: 1.1 google
expires: Fri, 01 Jan 1990 00:00:00 GMT
status: 302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CUR OUR NOR"
content-length: 0
x-xss-protection: 1; mode=block
date: Thu, 22 May 2025 23:52:11 GMT
content-type: text/html;charset=UTF-8

GET /
csync.loopme.me/ Frame 4E4B 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E4B
Redirect Chain

https://www.temu.com/api/adx/cm/pixel?google_push=AXcoOmThp0LVgj-kpnCUniRvcsEMtIctxjKDWAzxavoKdMLQ-LZccDeVfaCfzASFAcCzAnl_WLuzz5iMmrpYp8_Iix7RoVWuKimDYA
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmThp0LVgj-kpnCUniRvcsEMtIctxjKDWAzxavoKdMLQ-LZccDeVfaCfzASFAcCzAnl_WLuzz5iMmrpYp8_Iix7RoVWuKimDYA&google_nid=whaleco_services_llc

170 B
188 B

136ms
136ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmThp0LVgj-kpnCUniRvcsEMtIctxjKDWAzxavoKdMLQ-LZccDeVfaCfzASFAcCzAnl_WLuzz5iMmrpYp8_Iix7RoVWuKimDYA&google_nid=whaleco_services_llc

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 22 May 2025 23:52:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1747957932556|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmThp0LVgj-kpnCUniRvcsEMtIctxjKDWAzxavoKdMLQ-LZccDeVfaCfzASFAcCzAnl_WLuzz5iMmrpYp8_Iix7RoVWuKimDYA&google_nid=whaleco_services_llc
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1747957932556-9c8c2dc4762123e0cb80eee2d97709fc-20
cip: 162.245.206.244
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Thu, 22 May 2025 23:52:12 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 4E4B 0
12 B 136ms
135ms Image
text/html 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lk5aFPs5yKsGKI7SU1hRmu-4DwdGmO68fC0CRIihciW-KGEXptahXwC-syoMZBJMmCmG7V_37u

Requested by

Host: 8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com
URL: https://8868346fd14615450b587f9d767e32b3.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS