paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://swxqz.gradientking.com/e83waa275ldr74jwxx8lge9uRNXVPRW1UT3FqRVZOU1lZclRqbVItMzEyNy0yNjcyMTAzMS0wZmE3MDI2NC00Nzk5LXhBQ2IxV0FiVHUwdTZZOUxrTE9h/nfvfa5u4lp7/0C5S6sCn3EnOkA/111899987808844978348674748555947
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 15362
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Sat, 24 May 2025 18:45:59 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JW1SVGF0CR8P37XBXMYFRNP7

Redirect headers

accept-ranges: bytes
age: 15362
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Sat, 24 May 2025 18:45:59 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JW1SVGCMN4R4932R5WDMHV55

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 268ms
115ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab21b5e3b7a4550945c34fc2fa79d174676fba8a703880dfac1be3da3d0736a8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 944ef40aee97f7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 288ms
287ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 0
accept-ranges: bytes
x-nf-request-id: 01JW1SVGJ034RGHXRW2JG95RR4
cache-status: "Netlify Edge"; fwd=miss
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 286ms
285ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 0
accept-ranges: bytes
x-nf-request-id: 01JW1SVGJ052K2356T6QJY3TFX
cache-status: "Netlify Edge"; fwd=miss
date: Sat, 24 May 2025 18:46:00 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 87ms
86ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 8772
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JW1SVGJ0DNPR6KGCCYHR8BFR
cache-status: "Netlify Edge"; hit
date: Sat, 24 May 2025 18:46:00 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 84ms
83ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 10247
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JW1SVGJ0TJ6JZAJ2WXF29AEA
cache-status: "Netlify Edge"; hit
date: Sat, 24 May 2025 18:46:00 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 367ms
366ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 10247
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JW1SVGTY18RB45D9687FA9P3
cache-status: "Netlify Edge"; hit
date: Sat, 24 May 2025 18:46:00 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 76ms
75ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 15363
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JW1SVGTY1EK9APSXMXC610SQ
cache-status: "Netlify Edge"; hit
date: Sat, 24 May 2025 18:46:00 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
1 KB 75ms
73ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e4f1812a84834376f0eb2f9a07ea2f6d379bb6a72e182512fa3debece4cc99a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 944ef40be986f7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 370 KB
125 KB 2071ms
145ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7cdae29f13d6d0dafc7f90b0d1cc2788c8074929591f2177766a8d870f0b112a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sat, 24 May 2025 18:46:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 127378
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 g2ha8kox6p_qu.v2.js Show response
faucetfoot.com/j/ 68 KB
25 KB 358ms
199ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/j/g2ha8kox6p_qu.v2.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

2f441dd36482dae3abb7b940e19cba55065e172d814d749dcea4693e34f979ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-spot-jb3g.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 108 KB
34 KB 848ms
159ms Script
text/javascript 142.251.167.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

786768dcd5cef58e90cd1042b93237524bb89b7d1ae2a58d27dd7c9566c4f1d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 126 / 20232 / m202505200101 / config-hash: 2639553336502787513
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:46:01 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 24 May 2025 18:46:01 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34396
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 588 KB
179 KB 90ms
90ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d7a2ac42be2f8acb22dd52cc3493cb67bd727fde3d8a113e262248c6a2ec236

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a7f68292d50cd709f24f996c68d47dd1"
age: 3624
cf-ray: 944ef40be98df7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 13:30:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 411 B
337 B 333ms
333ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cefb14adf44d7be710ac086bd9956380a96dc8220bcca80af1144e3c5312877

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"d8cc960b7ac2417b4c245b40d1501e32"
age: 4715
cf-ray: 944ef40d0cbff7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 21 B
391 B 549ms
92ms Script
application/javascript 2606:4700::6812:18f2
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18f2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e04f4f2001b144c335dd007de2093486ea1406a609a3cb3b3f607853fb2fdc0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 944ef40fdf020fed-LAX
alt-svc: h3=":443"; ma=86400
content-length: 21
date: Sat, 24 May 2025 18:46:00 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
483 B 868ms
559ms Image
image/gif 2600:9000:215f:1600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=ad_300x250_7764548
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:1600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 101847
x-cache: Hit from cloudfront
x-amz-cf-id: qE-epwRSmLl7DErK7U79tTBb-_Vq-8C8cFozjXT6LzqfVj8nOI6oBw==
date: Fri, 23 May 2025 14:28:35 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 144825e0e5f4523d1f7ce8c9b62cd908.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: YUL62-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 runtime.688a9519bf222c577628.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 73ms
72ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: adb9d1101e62377f34b6db7996ffc4eb80f8968ae7063b988ba2d85ee2ec2a5f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"2014aef5a932767aee99c8c09ee9aea2"
age: 4723
cf-ray: 944ef40fac8af7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.de88eb0a31bf4b182063.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 519 KB
157 KB 90ms
90ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6395a8c7b596927e52b00afe7511a91cf9043ae95d61763316ab139974b1bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"81a507d88d3b44587deef78119119de8"
age: 4723
cf-ray: 944ef40fac8bf7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:00 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 559 B
467 B 75ms
75ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 4709
cf-ray: 944ef412ff1af7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:01 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:47 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 506B 503 B
427 B 566ms
80ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 4725
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 944ef41609537c41-LAX
content-encoding: br
content-type: text/html
date: Sat, 24 May 2025 18:46:01 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 2918 503 B
0 560ms
560ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 987c2cd02eee536198d4dbd8455b2e86ee1aec28cb88ad7ed45a03a71897e6c2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 4725
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 944ef41609537c41-LAX
content-encoding: br
content-type: text/html
date: Sat, 24 May 2025 18:46:01 GMT
hw-country-code: US
last-modified: Mon, 19 May 2025 13:12:35 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/14/desktop/Chrome/ 583 B
920 B 1248ms
934ms XHR
application/json 2600:9000:215f:c400:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Sat/14/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:c400:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: a1b7e6bda43a322e4ff5f8674c7727fd530248d4b87009bb1b09eb26b30082e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2736
via: 1.1 90b7b9dc3aa8817f0cef3cfd45fb8916.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 583
x-amz-cf-id: ugbvlgeMptvGoV_KsgxY-XU-NuN8jFpgpkGoVlObEpMypluzZESZMg==
date: Sat, 24 May 2025 18:00:25 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 148 KB
39 KB 248ms
98ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 405eeb35412ae192bb068e4e7c064b11eea03be94968779c15f8f1b5da38ce96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "e89d54367fb3d00297591f0cec31cd54"
via: 1.1 google
cf-ray: 944ef4141f2b7ec5-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39550
date: Sat, 24 May 2025 18:46:01 GMT
content-type: application/javascript
last-modified: Sat, 24 May 2025 18:20:37 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
2 KB 74ms
73ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 4713
cf-ray: 944ef4132f91f7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:01 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:33 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 641ms
349ms Script
application/javascript 205.251.251.173
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 205.251.251.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-205-251-251-173.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 892
via: 1.1 6dc264f051e2557bd6880a40b0455076.cloudfront.net (CloudFront), 1.1 612d3e065148a94cbbe94139733f662e.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: A9eGlv_pos7aDQKyxzmDQLTNCXuX9jPuVkL3nPWmZUbjBtzMrMrBdw==
date: Sat, 24 May 2025 18:31:10 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, YUL62-C2
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
590 B 3314ms
221ms Image
image/gif 2606:50c0:8001::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: afe6c2ebf8b6b5f33a26f6a84781a71ef53a71f2
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 9505:14FA39:997900:B00289:681072E4
expires: Sat, 24 May 2025 18:51:04 GMT
x-cache: HIT
date: Sat, 24 May 2025 18:46:04 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350037-TOJ
x-cache-hits: 5
source-age: 179
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding,Origin
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1748112365.637322,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 127ms
127ms Script
text/javascript 142.251.167.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 2002
x-content-type-options: nosniff
expires: Sun, 24 May 2026 18:12:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 24 May 2025 18:12:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505220101/ 63 KB
23 KB 447ms
446ms Other
text/plain 142.251.167.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505220101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

8c9c942cbc4b50a998e5204686305e5192f73e9a64425654ef4b8716015b8b67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 10260624382802495031
age: 2001
x-content-type-options: nosniff
expires: Sat, 31 May 2025 18:12:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 24 May 2025 18:12:40 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23619
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505220101"

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 451ms
155ms Script
text/javascript 3.162.3.126
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.126 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-126.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 355
via: 1.1 09a1b8b4052fdbde9561c3a648dc72bc.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GqyxDWrUIHnxDUyMVmEtNJ3E3UvGmDQ_jp-jQiJaIGYOuq9P6tBusA==
date: Sat, 24 May 2025 18:40:10 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256

POST
H3 200 n1ot5460pz7ze5xcn26z1fe0h Show response
faucetfoot.com/post/ 295 B
319 B 207ms
114ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/post/n1ot5460pz7ze5xcn26z1fe0h

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/j/g2ha8kox6p_qu.v2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

22ba029db76633d978d94354fccb1180098012ba5dd9a4045ee79eeb19001214

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-test-jqg4.gce-us-west1, 1.1 google
expires: Sat, 24 May 2025 18:46:00 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Sat, 24 May 2025 18:46:01 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 201 KB
65 KB 424ms
159ms Script
application/javascript 2607:f8b0:4004:c1f::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4ba378a9c7991f762d7d7e745f33e39a41af554f372405d20ba3ff5609e0652f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-XYmYeH2IBemqOFfh9BHNzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw1JBiOHnrNtNFIG69eY51MhAbKlxitQfi--susT4H4g_1l1l_AHGRxBXWBiD-VHWDVaD6BmsS-03WAiAOdbzJGgvCaTdZU4F418ZbrAeBuEn7NmsXEJv53Wa1A2IhHo5Xy08cZBP4cbb9IKOSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGpkYGegUF8gQEABRdFKQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-XYmYeH2IBemqOFfh9BHNzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 506B 17 KB
7 KB 78ms
78ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4724
cf-ray: 944ef4171a407c41-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250515.1/iframe/ Frame 2918 17 KB
0 72ms
72ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250515.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4724
cf-ray: 944ef4171a407c41-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:35 GMT
vary: Accept-Encoding
server: cloudflare

GET 76c6d5f1-fa4d-4e2d-9800-01a684759611
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 1358ms
529ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 24 May 2025 18:46:02 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 250647
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 190ms
105ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 51598
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Sat, 24 May 2025 04:26:04 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 944ef418b84914f8-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250515.1/ 3 KB
1 KB 75ms
75ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250515.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/runtime.688a9519bf222c577628.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 4721
cf-ray: 944ef4182e09f7d9-LAX
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/javascript
last-modified: Mon, 19 May 2025 13:12:27 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 831ms
153ms Script
text/javascript 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: swxqz.gradientking.com
URL: https://swxqz.gradientking.com/e83waa275ldr74jwxx8lge9uRNXVPRW1UT3FqRVZOU1lZclRqbVItMzEyNy0yNjcyMTAzMS0wZmE3MDI2NC00Nzk5LXhBQ2IxV0FiVHUwdTZZOUxrTE9h/nfvfa5u4lp7/0C5S6sCn3EnOkA/111899987808844978348674748555947
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 6e58a385f842ee845cb6525da77301a5e042272372b660f80d10f15feb574168

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 453ms
187ms Script
text/javascript 2607:f8b0:4004:c07::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c07::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2408f96d0ae09f62f95d73bcc6f521f5e7cd2b62f46a57ae450a36a386632fae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4408055776961230618
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:46:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145165
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 683ms
244ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-225-240-34.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
778 B 1024ms
165ms Fetch
application/json 3.226.20.188
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.226.20.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-226-20-188.compute-1.amazonaws.com
Software: /
Resource Hash: ffe82ef2e1bde604dceb3051ad5ae77ca8dfd2e9b6b3c990baeb8a47f3cf9ce6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
685 B 2760ms
243ms Fetch
application/javascript 52.200.238.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.238.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-238-32.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 4f743da892f806dff542c2b9b6a6dc64f72c1efda9e62bd13702792d5d9561f4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 283ms
133ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: b9e3b2cd022a4f80f464c85093398adce2ee660338b4df9960d4c507ba29def0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
540 B 1582ms
575ms Fetch
text/plain 54.225.240.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.240.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e8640e7d9f894029a14912a589c9279214b13d7474289e9c8a11d28918cfcb45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 7405d8239d76d356
request-time: 9
access-control-allow-credentials: true
expires: Sun, 25 May 2025 18:46:03 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Sat, 24 May 2025 18:46:03 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=V0Oq8nxHdDdHNTZkTEpNblB2blgyN3Q2bVI5WnFYOElCZUFKQnBYZTJMeno3NkVtWXFMLzBWalhPZFpQZXU2U3pSNTJlaS9udW9qZ1FzVUZWM1FzRmVSWjVGMjZydGN0cjZ4bHJPd3VyMnN6amV6V2dQUS9WM2YrdGNkWn...

352 B
923 B

371ms
127ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=V0Oq8nxHdDdHNTZkTEpNblB2blgyN3Q2bVI5WnFYOElCZUFKQnBYZTJMeno3NkVtWXFMLzBWalhPZFpQZXU2U3pSNTJlaS9udW9qZ1FzVUZWM1FzRmVSWjVGMjZydGN0cjZ4bHJPd3VyMnN6amV6V2dQUS9WM2YrdGNkWnlqYWtESU9jeXZJcmFJSXozV1FZWXovSVJpZ2xaNmtPWDRSL093OSsvWFlNTzVNUEFFb3ZGNnIvblhqWFBVeWFtQUl3U1BiN0FySWwxeEJJamtyenc1SFUrbWRWa3R1cnp5aXFPMUZyb3pFaFpoNnlkMStBazFGKzFVZlpFVXJwZ0JCYVZ5QTFnfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98983bc0797df1dc55e4aa522d8e987407fbd4580f95929d14f1ef331dc7e65c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 517313
expires: 0
access-control-allow-origin: null
date: Sat, 24 May 2025 18:46:05 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=V0Oq8nxHdDdHNTZkTEpNblB2blgyN3Q2bVI5WnFYOElCZUFKQnBYZTJMeno3NkVtWXFMLzBWalhPZFpQZXU2U3pSNTJlaS9udW9qZ1FzVUZWM1FzRmVSWjVGMjZydGN0cjZ4bHJPd3VyMnN6amV6V2dQUS9WM2YrdGNkWnlqYWtESU9jeXZJcmFJSXozV1FZWXovSVJpZ2xaNmtPWDRSL093OSsvWFlNTzVNUEFFb3ZGNnIvblhqWFBVeWFtQUl3U1BiN0FySWwxeEJJamtyenc1SFUrbWRWa3R1cnp5aXFPMUZyb3pFaFpoNnlkMStBazFGKzFVZlpFVXJwZ0JCYVZ5QTFnfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 230996
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 24 May 2025 18:46:04 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_02624b81-8616-40d4-8cae-0c1683cbcbc7_1748112362170
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMDI2MjRiODEtODYxNi00MGQ0LThjYWUtMGMxNjgzY2JjYmM3XzE3NDgxMTIzNjIxNzAQABoNCOqnyMEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=f77fdd286fb9d624359d4190d9c6c89ed0d28054fdc18168b899635779871653791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=f77fdd286fb9d624359d4190d9c6c89ed0d28054fdc18168b899635779871653791426b5417dce21&rand=06545879
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=f77fdd286fb9d624359d4190d9c6c89ed0d28054fdc18168b899635779871653791426b5417dce21&rand=06545879&expected_cookie=12672e88-40b2-47e1-a649-85009c9e89f3

0
144 B

137ms
136ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=f77fdd286fb9d624359d4190d9c6c89ed0d28054fdc18168b899635779871653791426b5417dce21&rand=06545879&expected_cookie=12672e88-40b2-47e1-a649-85009c9e89f3
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: AA5C6E6E27E74D2F9DEC55C36A8B81E6 Ref B: LAX311000110019 Ref C: 2025-05-24T18:46:04Z
x-li-fabric: prod-lva1
x-li-uuid: AAY15iCD0hq2okcxRbIHmA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 24 May 2025 18:46:04 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=f77fdd286fb9d624359d4190d9c6c89ed0d28054fdc18168b899635779871653791426b5417dce21&rand=06545879&expected_cookie=12672e88-40b2-47e1-a649-85009c9e89f3
x-msedge-ref: Ref A: BE722F91D25D4AEBA1A1BB779A3EF4B4 Ref B: LAX311000110019 Ref C: 2025-05-24T18:46:04Z
x-li-fabric: prod-lva1
x-li-uuid: AAY15iCBtkamE/MbXobeLw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 24 May 2025 18:46:04 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_02624b81-8616-40d4-8cae-0c1683cbcbc7_1748112362170
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_02624b81-8616-40d4-8cae-0c1683cbcbc7_1748112362170

1 KB
2 KB

129ms
128ms

Script
application/javascript

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_02624b81-8616-40d4-8cae-0c1683cbcbc7_1748112362170
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: 81fe8f7362ab8e53d759f1463697edfaf59a8d4a482cbb717e2c515b7d2f5080

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:04 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_02624b81-8616-40d4-8cae-0c1683cbcbc7_1748112362170
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:04 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 2062ms
1021ms XHR
application/javascript 205.251.251.173
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 205.251.251.173 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-205-251-251-173.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 56564
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: gtcaBczmXLJvc-L_Nk75PhpTCfgvG8vV7IPu11wQNE5fCiRSktPfrg==
date: Sat, 24 May 2025 03:03:20 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 9a6f07a84b60a85466bb31603767843c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: YUL62-C2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 1275ms
138ms Script
application/javascript 54.192.51.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-26.yul62.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 3362
via: 1.1 9d44e85808045d940d36e8cfb772edae.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: HBZO8e20Qz2xmoRXndIGietG5efsbtRgtjngZBTktGX70iISHHyumw==
date: Sat, 24 May 2025 17:50:01 GMT
content-type: application/javascript
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET config
c.amazon-adsystem.com/cdn/prod/ 0
0

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
375 B 1087ms
504ms Fetch
application/json 3.161.214.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fswxqz.gradientking.com%2F&pid=RX5S8EXyU3nlM&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=a601262b-3220-4721-945e-cba08bccf75b&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.214.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-214-59.yul62.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 0880eac0689b5b1cff547e39e0daa976.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: CaAZcunaytN860zBKTVkM4Q9zOWZ2Sr5R24IZ2YdoXhWmOrdjpOiPQ==
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: YUL62-P1
server: Server

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 1164ms
257ms XHR
application/json 34.193.179.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.179.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-179-5.compute-1.amazonaws.com
Software: /
Resource Hash: a336bcd893cb7bafabc4c460b11598dad44a626ed22d2d48b2ffd4654a43abf0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=utf-8

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 925ms
219ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Sat, 24 May 2025 18:46:03 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
628 B 533ms
110ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 20637
x-goog-stored-content-encoding: identity
expires: Sat, 24 May 2025 13:15:04 GMT
x-goog-stored-content-length: 43
date: Sat, 24 May 2025 18:46:02 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwqtvh56VQsUgcmWAi6drHIX4zUCLnIdhHCfrjmn5Im1gC2CkZRJCaSDhn4MMG9uArr567qUFEI
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 944ef41c4c810900-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 favicon.ico
ad.doubleclick.net/ 1 KB
572 B 752ms
139ms Image
image/x-icon 142.251.163.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 14793
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sun, 25 May 2025 14:39:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 14:39:30 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 90ms
89ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.7347441698906896
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 20637
x-goog-stored-content-encoding: identity
expires: Sat, 24 May 2025 13:15:04 GMT
x-goog-stored-content-length: 43
date: Sat, 24 May 2025 18:46:02 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwqtvh56VQsUgcmWAi6drHIX4zUCLnIdhHCfrjmn5Im1gC2CkZRJCaSDhn4MMG9uArr567qUFEI
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 944ef41cacdc0900-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 33DC 2 KB
1 KB 1115ms
287ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=163639
content-encoding: gzip
content-length: 859
content-type: text/html
date: Sat, 24 May 2025 18:46:03 GMT
expires: Mon, 26 May 2025 16:13:22 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 1491 1 KB
2 KB 567ms
79ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1599
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Sat, 24 May 2025 18:19:24 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: AAO2VwoaelKrfrelpwuNSr_OvmLlWNwU8ZSbL23G-ONh9pPVMOKy7k1n5xMWvi0j7AuAAaXza6pzBXo

POST
H2 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 656ms
157ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cc0a29a23924d46ac6a3417031bb476784588158ca72f4bb67d3882114c93d3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112363&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=5LrF5YRfsw0bDzIUPoHblgG09PylS9h%2BBanbOpmvrJ4%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json; charset=utf-8
vary: Origin
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112363&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=5LrF5YRfsw0bDzIUPoHblgG09PylS9h%2BBanbOpmvrJ4%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 944ef41ce8477ee9-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H2 200 auction Show response
prebid.intergient.com/openrtb2/ 183 KB
30 KB 1103ms
609ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4c791ad421117659c4e801c01399e1be767e9eb9f991f8b487f92c05ec491ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112363&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=5LrF5YRfsw0bDzIUPoHblgG09PylS9h%2BBanbOpmvrJ4%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json
vary: Origin
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112363&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=5LrF5YRfsw0bDzIUPoHblgG09PylS9h%2BBanbOpmvrJ4%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 944ef41ce84a7ee9-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
624 B 1493ms
148ms Fetch
application/json 54.192.51.121
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.51.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-51-121.yul62.r.cloudfront.net
Software: istio-envoy /
Resource Hash: a2667314214e9a28a5afeb9cb105a6c9310a6d70191513993074fd9455d1ceaa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 de0a592002999100a0085e087a370864.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: kQ5fzK6txuGuPwvV7ff_QmS_1mRTOhO5N5GMPnmC-JwJyPReU7Pc_g==
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 744 B
821 B 1532ms
559ms Fetch
application/json 44.203.46.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.203.46.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

75c9962cfde498f6862ddadec8ff13bc851798210bae1e0c88ee8bd46083e7e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 465
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 498 B
675 B 1704ms
731ms Fetch
application/json 44.203.46.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.203.46.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0e983b9a44d689927ffb4218ed06d6bba1ef2d6256be79c166262cb0152fdf1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 319
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 1405ms
433ms Fetch 44.203.46.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.203.46.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 1403ms
431ms Fetch 44.203.46.172
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.203.46.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-175-5.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 12 KB
6 KB 628ms
359ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.gradientking.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.36.0&x_source.tid=843729c3-03f0-4928-849f-57c99392f7d6&l_pb_bid_id=73c15ca4e4646f8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=25a7aa81-3754-4187-8e5d-48e189da084c&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.06318518107172122
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 3371b77017b5a29185eb21eb5bf4cd6cec151cdcdbba84799520f3c31d2175ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 523 B
883 B 629ms
360ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.gradientking.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=843729c3-03f0-4928-849f-57c99392f7d6&l_pb_bid_id=740349904811ce8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=efc6d951-8277-470d-ab98-c4a40008f0a8&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.14324592669368674
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: b924e0e2ad6f589233dd44a551409dc0f626901158cd0564cb6f5f1affa74f71

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 523
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
889 B 628ms
359ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.gradientking.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=843729c3-03f0-4928-849f-57c99392f7d6&l_pb_bid_id=7594845ead22161&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=43739900-4cda-47bb-8974-f10bde541198&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.5172676671874797
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 4829bcc5866f889b816e81bb62ff1ca85d189d2104d2ad9b04b408b2072b41db

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 529 B
1 KB 626ms
357ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fswxqz.gradientking.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.36.0&x_source.tid=843729c3-03f0-4928-849f-57c99392f7d6&l_pb_bid_id=76108d6b0e81dc5&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=a22ffc8a-9e91-4d4b-a8a4-67d374be6fd4&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.2765507577209064
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 90839774085edb70d2683015d2c735b0e33cb6457a1fc25e2adfed6967e4a5f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 529
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 auction Show response
elb.the-ozone-project.com/openrtb2/ 55 B
541 B 548ms
105ms Fetch
application/json 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0267cc604a78ece1303ebbe0695f11395bc7d94f9749007d9aa7b0ce2c070e2c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
cf-ray: 944ef41cb82b7d86-LAX
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: *

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 1341ms
764ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:03 GMT
server: nginx

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 499ms
220ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e24a589c704288fdb30b37a94c293dd00460dc5f6387921247a29b63bbb916c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1594ms
279ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 24 May 2025 18:46:04 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1822ms
369ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 24 May 2025 18:46:04 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1982ms
387ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 24 May 2025 18:46:04 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 2220ms
397ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Sat, 24 May 2025 18:46:04 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 819ms
164ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 04508fb7976c1df31ac95f12ff086a62fd0958a113fcc49b9735fcd6f997acf3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.249
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Sat, 24 May 2025 18:46:02 GMT
content-type: text/plain
vary: Origin

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 39 B
667 B 600ms
91ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f92148bc1181fb468bfb90086458f78f67f9b85b8c67a8d29d703ce0d37c1b2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEDnu5owD36JaXFnjqIj3SpYBZmT0IY65GaJzBTsnsJCvbRkyWnS9%2Filr0Ww7M2%2FFSVzPEOkCewwbk4oQE1z8s8Qlm5MjJviLABSBH6qZQ3DxFJB1EU4PzP6%2FRj0iALKZJk4rMSu"}],"group":"cf-nel","max_age":604800}
cf-ray: 944ef41d3cb72b57-LAX
expires: 0
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=86400
content-length: 39
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json
vary: Accept-Encoding
server: cloudflare

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 1431ms
123ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.36.0&cb=20060768296&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:03 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 783ms
165ms Fetch
application/json 3.208.175.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.36.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
582 B 1731ms
244ms Fetch
application/json 68.67.181.102
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.102 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: c6914d02-3acd-4517-8f55-32de9e03b4de
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:04 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 1150ms
594ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 24 May 2025 18:46:02 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 1200ms
269ms Fetch
application/json 23.20.54.180
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1748112362548&to=600&aun=pw-160x600_atf&pubcid=7e20c29d-157d-459b-88e5-dfdc3c442609&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=25a7aa81-3754-4187-8e5d-48e189da084c&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=3686&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.54.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-54-180.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 1315ms
385ms Fetch
application/json 23.20.54.180
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1748112362548&to=600&aun=pw-160x600_btf&pubcid=7e20c29d-157d-459b-88e5-dfdc3c442609&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=efc6d951-8277-470d-ab98-c4a40008f0a8&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=3686&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.54.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-54-180.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 1201ms
271ms Fetch
application/json 23.20.54.180
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1748112362549&to=600&aun=leaderboard_atf&pubcid=7e20c29d-157d-459b-88e5-dfdc3c442609&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=43739900-4cda-47bb-8974-f10bde541198&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=3686&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.54.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-54-180.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 1314ms
385ms Fetch
application/json 23.20.54.180
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.36.0&lt=1748112362549&to=600&aun=leaderboard_btf&pubcid=7e20c29d-157d-459b-88e5-dfdc3c442609&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=a22ffc8a-9e91-4d4b-a8a4-67d374be6fd4&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.36.0%22%7D&ogu=null&ns=3686&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.20.54.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-20-54-180.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1748112362772&did=did-0046&se=e30&duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.grad...
https://rp4.liadm.com/j?dtstmp=1748112362772&did=did-0046&se=e30&duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.gra...

13 B
370 B

910ms
133ms

Fetch
application/json

54.175.179.23
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1748112362772&did=did-0046&se=e30&duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.gradientking.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo3&n3pc=true
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 54.175.179.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-175-179-23.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 1f635830-286a-4646-b71b-b2329bb6d831
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1748112362772&did=did-0046&se=e30&duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&tv=9.36.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fswxqz.gradientking.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo3&n3pc=true
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Sat, 24 May 2025 18:46:03 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 1585ms
221ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532337.ip-162-19-138.eu

Software

Resource Hash

87cdc23eac75fd506d4573162c33781ccdf43d967dd5f59a4d51d5e8a80f0447

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 AGSKWxWqK1eZwKBZqtNg_WNfgJQn0oZDSWxwMTSlOTskIJzR1P2fWQSqaZPPjzUnqrSnQo5JLmopLl3Hs8hjccPpp7q3MMfraWjJwW1O_7_JiEDkhQXdxnvz19oE0O5qIEalFWtg0LOBbg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 599ms
598ms Script
application/javascript 2607:f8b0:4004:c1f::65
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWqK1eZwKBZqtNg_WNfgJQn0oZDSWxwMTSlOTskIJzR1P2fWQSqaZPPjzUnqrSnQo5JLmopLl3Hs8hjccPpp7q3MMfraWjJwW1O_7_JiEDkhQXdxnvz19oE0O5qIEalFWtg0LOBbg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4MTEyMzYzLDc5MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsIm9hSzdhRm9fZi1VIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInN3eHF6LmdyYWRpZW50a2luZy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::65 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f993d13d077f1308f60dc511e7deea65dbf1f4929e26909a46bda2ed06530351

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-zq5RJTP_0SIBrnOViMD5Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtHikmJw0ZBiWMS_i-nErdtMF4C49eY51slAbKhwidUeiO-vu8T6HIg_1F9m_QHERRJXWBuA-FPVDVaB6husSew3WQuAONTxJmssCKfdZE0F4jUbb7FuBuIm7dusXUBs5neb1Q6Ihbg5Xi8_cZBN4Ma1Nf5KGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgamRgZ6BgbxBQYAnw9GEg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-zq5RJTP_0SIBrnOViMD5Gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame FE79 102 KB
28 KB 515ms
136ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f155.1e100.net

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1973
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:13:10 GMT
expires: Sat, 24 May 2025 19:03:10 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 1466ms
144ms Script
application/javascript 2600:9000:269f:3000:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:269f:3000:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 1541
x-cache: Hit from cloudfront
x-amz-cf-id: 5v86PJ_HFAAM3bSt64ywuw9z0M0tVIkCPy392jNNqerEHo98MMNF2g==
date: Sat, 24 May 2025 18:20:24 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 a181621f27665bbfa5459df48eceea5a.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: YUL62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 247ms
70ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 820637
x-goog-stored-content-encoding: gzip
expires: Fri, 15 May 2026 06:48:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Thu, 15 May 2025 06:48:46 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwqQ3cK0YoGx_uXG6j0gqdsrI5WggkF9xKRcPR_W71-VCnQr_EiOeK00Gm3-5ipV1sdNUfSKanI
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 863ms
680ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Sat, 24 May 2025 18:46:03 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 7b556f8ed40be804c59dce15a4a3233f

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 376ms
96ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 453818
cf-ray: 944ef41fed8c08d0-LAX
expires: Tue, 27 May 2025 18:46:03 GMT
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 680ms
421ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Sun, 25 May 2025 18:46:03 GMT
access-control-allow-origin: *
date: Sat, 24 May 2025 18:46:03 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 312 KB
111 KB 154ms
153ms Script
application/javascript 2607:f8b0:4004:c17::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55l1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103211513~103233427~103252644~103252646~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0b8f1379af8ea529dce6354cf78a9991e3535b63bfc3ecb85c6ced6e38bb283b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1075:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1075:0"}],}
expires: Sat, 24 May 2025 18:46:03 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1075:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1075:0
content-length: 113291
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 1273ms
133ms Fetch
text/plain 2607:f8b0:4004:c07::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55l1v9101576445za200&_p=1748112359972&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101509157~103116026~103130495~103130497~103200004~103211513~103233427~103252644~103252646~104481633~104481635&cid=4840058.1748112363&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748112363&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.gradientking.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4364
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 962ms
126ms XHR
text/plain 3.237.175.195
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.237.175.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-237-175-195.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 1245ms
129ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fprebid.intergient.com%252Fsetuid%253Fbidder%253Dappnexus%2526gdpr%253D%2526gdpr_consent%253D%2526gpp%253D%2526gpp_sid%253D%2526f%253Di%25...
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=9164073885411081074

86 B
1 KB

149ms
148ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=9164073885411081074
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112364&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=xVMYSgO8EJMEPp4FM0dlhy0151HHzjL2Qm8gdW6xW3I%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 24 May 2025 18:46:04 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112364&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=xVMYSgO8EJMEPp4FM0dlhy0151HHzjL2Qm8gdW6xW3I%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944ef42608bfcb86-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=9164073885411081074
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 6fa25569-24bb-4121-90e2-84ec70600242
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:04 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 1113ms
123ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 486ms
115ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 480ms
115ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=SLmrOMloE-f35TYX42R-97039dcbe2&sid=vGogLmholC-vbxdEYEP-97039dcbe2&cv=2.1.102&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:03 GMT
vary: Origin

GET
H3 200 AGSKWxUkGSc4OxofCsOc2p-LUvt5haFV-HsAi1665esgQc3RwUN6ecM5a8HL2KE1RBY50VYmChOCW-ZgMylr0d8GpxYFAhtOsjj_Av5RNjraJgxD4MNf2pHUy8nDwsGirRLDNNd3cQpsIg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
4 KB 154ms
154ms Script
application/javascript 142.251.179.100
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUkGSc4OxofCsOc2p-LUvt5haFV-HsAi1665esgQc3RwUN6ecM5a8HL2KE1RBY50VYmChOCW-ZgMylr0d8GpxYFAhtOsjj_Av5RNjraJgxD4MNf2pHUy8nDwsGirRLDNNd3cQpsIg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4MTEyMzYzLDg3NjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwib2FLN2FGb19mLVUiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwic3d4cXouZ3JhZGllbnRraW5nLmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-211-170-34.compute-1.amazonaws.com

Software

ESF /

Resource Hash

dfdfebbc824b529e3fe040d8aa17ca1060ad39c61a58279c6913e61b8018e701

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0iUH6QdM0oMvbJY-8UrUlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:03 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw1pBiOHnrNtNFIG69eY51MhAbKlxitQfi--susT4H4g_1l1l_AHGRxBXWBiD-VHWDVaD6BmsS-03WAiAOdbzJGgvCaTdZU4F418ZbrAeBuEn7NmsXEJv53Wa1A2IhHo7Xy08cZBN4MeHHaWYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwNTIwM9A4P4AgMACXlFVA"
content-security-policy: script-src 'report-sample' 'nonce-0iUH6QdM0oMvbJY-8UrUlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 478ms
230ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 368a36ea46945f7e130bb2e09fbb8e2c18301eb1b7c141d693d946280d008bfa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/json
x-cloud-trace-context: 23b26cd12d50190d8ea97b53345db97b
server: Google Frontend
access-control-allow-headers: X-Requested-With

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 388ms
132ms Fetch
text/plain 2607:f8b0:4004:c07::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55l1v9102396898za200zb9101576445&_p=1748112359972&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130495~103130497~103200004~103211513~103233427~103252644~103252646~104481633~104481635&cid=4840058.1748112363&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748112364&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.gradientking.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1748112359972&tfd=5218
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55l1v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103211513~103233427~103252644~103252646~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/plain
server: Golfe2

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlVxdGtfMGhnRjluUWQxdS1YcWdlSDQzMUJ6SFdXRVBSQzRGMXBULTVsSEk&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MlVxdGtfMGhnRjluUWQxdS1YcWdlSDQzMUJ6SFdXRVBSQzRGMXBULTVsSEk&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

124ms
124ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:04 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Sat, 24 May 2025 18:46:04 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=abf4665b-e314-4656-8b61-b74aeac478c3&bid=1e2n4ou

70 B
440 B

124ms
123ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=abf4665b-e314-4656-8b61-b74aeac478c3&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:04 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=abf4665b-e314-4656-8b61-b74aeac478c3&bid=1e2n4ou
content-length: 191
date: Sat, 24 May 2025 18:46:04 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-buN1Ep1E2pVBjnt8WfUrYc5m0qFLUmI8pOs-~A&gdpr=0

70 B
440 B

211ms
124ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-buN1Ep1E2pVBjnt8WfUrYc5m0qFLUmI8pOs-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:05 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-buN1Ep1E2pVBjnt8WfUrYc5m0qFLUmI8pOs-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2929127410558735037&newuser=1&referrer_pid=m51mh00

70 B
440 B

305ms
127ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2929127410558735037&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:05 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=2929127410558735037&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 24 May 2025 18:46:04 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ps.eyeota.net/match?uid=9164073885411081074&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

126ms
126ms

Image
image/gif

3.233.22.19
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=9164073885411081074&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.233.22.19 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-233-22-19.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Sat, 24 May 2025 18:46:04 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=9164073885411081074&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1040.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bfa25a30-8faa-44d8-9b58-d2611745c540
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:04 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 401ms
124ms Image
text/plain 54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 819 B
1 KB 211ms
210ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

72c807bb4d5c31c9d54ae16ed02d96a0902df0b0648d26a4eb1a780d8f21c9be

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/json
vary: Origin

GET
H3 200 iframe. Show response
fundingchoicesmessages.google.com/f/AGSKWxUlkKD07Q5v2Vx8JFEfyDvmdpQW363tDPiEJA3CogiroG3tnR2bdEHkj7GIgt2D_MaF6Czb5L82sWaZo89bvJ0JdVeqtCXkCOJKCH9AwqItGeUO0YUGVQplihUsEE5wlRKUoX-H_bHtWAuxCQwbWbQs0fn90... 54 B
109 B 141ms
140ms Script
application/javascript 142.251.179.100
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUlkKD07Q5v2Vx8JFEfyDvmdpQW363tDPiEJA3CogiroG3tnR2bdEHkj7GIgt2D_MaF6Czb5L82sWaZo89bvJ0JdVeqtCXkCOJKCH9AwqItGeUO0YUGVQplihUsEE5wlRKUoX-H_bHtWAuxCQwbWbQs0fn906d9chJgdKLhxQYpVdG_C37vlI3PWzTb/_-ads/oas//adv.html/template/ad..php/ad//doubleclick/iframe.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1181ad1c03d50e934e9ed7f943223cf062ad5f951940ef4ddbb84d40a4eaa975

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-23Tv8MNNuRy_n7_r42QkbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:04 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw0pBiaL15jnUyEBsqXGK1B-L76y6xPgfiD_WXWX8AcZHEFdYGIP5UdYNVoPoGaxL7TdYCIA51vMkaC8JpN1lTgXjXxlusB4G4Sfs2axcQm_ndZrUDYiEejjfLTxxkE9jwou8pk5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRgZ6BQXyBAQDa3UAT"
content-security-policy: script-src 'report-sample' 'nonce-23Tv8MNNuRy_n7_r42QkbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 osd.js Show response
pagead2.googlesyndication.com/pagead/ 61 B
76 B 372ms
123ms Script
text/javascript 142.251.111.154
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/osd.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.oaK7aFo_f-U.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMz2V7N63BlUU_QN7oXMtGJ0hyiPBA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.154 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f154.1e100.net

Software

cafe /

Resource Hash

c45c8b81ccfcbc08127b74787d1b5974078756233de947986c357e28ed8f13ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 16023549773543154165
age: 2021
x-content-type-options: nosniff
expires: Sat, 24 May 2025 19:12:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 18:12:23 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 51
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUs-r3n1btq-vjhK2hJozIZ6XN9glQjHGl3dpdkt1FZPJ5xW-Yr_2mliH3p2zHsu4ol4eqJbBEKuZyAOED-RZAxvuOvs3MJ1kbFbOTCHgy-5zqokXcQHoUCP33srqeu4-878VqoMA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 270ms
140ms XHR
text/html 142.251.179.100
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUs-r3n1btq-vjhK2hJozIZ6XN9glQjHGl3dpdkt1FZPJ5xW-Yr_2mliH3p2zHsu4ol4eqJbBEKuZyAOED-RZAxvuOvs3MJ1kbFbOTCHgy-5zqokXcQHoUCP33srqeu4-878VqoMA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--GXnNqIi70uMLBiIrMVqqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1JBi-FB_mfUHEJv53Wa1A2IhHo43y08cZBOYsfLQQmYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSkZ2AeX2AAAJkbJ3g"
content-security-policy: script-src 'report-sample' 'nonce--GXnNqIi70uMLBiIrMVqqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 6D50 20 KB
7 KB 118ms
118ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99636
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 24 May 2025 18:46:04 GMT
expires: Sun, 25 May 2025 22:26:40 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 130 KB
45 KB 667ms
666ms Fetch
text/plain 142.251.167.157
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=159062010318385&correlator=2499915490328940&eid=31092114%2C31092255%2C31092498%2C95353384%2C95361095%2C31085777%2C83321073%2C95347490&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1748112364782&lmt=1748112364&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fswxqz.gradientking.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDdlMjBjMjlkLTE1N2QtNDU5Yi04OGU1LWRmZGMzYzQ0MjYwOVgBEh0KDmVzcC5jcml0ZW8uY29tGNCc95zwMkgAUgIIZBIYCgl5YWhvby5jb20Ykqj3nPAySABSAghvEhQKBW9wZW54GNSf95zwMkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Y0Jz3nPAySABSAghkEu4BCghydGJob3VzZRLYATlaM2VzZkpPZEQxRW9NSzZBSlRaSlZrWTBOLzNmdndhQ21zNURWWHV4bkZHUitRVyt0OGtMald4dks3ZTJvYUJUNmhVbDN1QzhNUHl2a1k0eUl2TUZOY09oVyttbGZGQ0t5ZHVkRjdVenJ0Ym1ITUpqTG10MUh3RWczZzA4VEVsSmpnVUV3dENlOVdXcGErSHFQTEV4OFYySUl0UzFnY2xuV1ovUUtwdWVqN3JkR2RxdXJDR0p2bDdodnlQTnZLYU5oS0c2R2VzMFNtUjhLdUFOVzkxK3c9PRiHqPec8DJIABKHAQoObGl2ZWludGVudC5jb20SczE2LUZld3dLUGsyd3IxenpMbmRZWkZ6cVVrOWlaaUlWWlZ3cFAyUXN2MjAvbk4xcXZMaDlRR09JMGpqU0tTQWNuQXFmbTBRL0NvM28welFYUUh2VlU2RjM4THkxcFJCNk44OXRDaFR0U20zcWNUaU5RPT1YAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1748112359952&idt=2014&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D30eec61cb0c6434a8b5a8c4e3edfa63a12362367%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26bid_type%3Dserver%26hb_format%3Dbanner%26hb_adid%3D140c93dcbbaa272d%26hb_size%3D160x600%26hb_pb%3D0.29%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_cache_host%3Dprebid.adnxs.com%26hb_bidder%3Ds2s_ix%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.29%26hb_adid_s2s_ix%3D140c93dcbbaa272d%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.14%26hb_adid_rubicon%3D132ca4a3091a86d08%26hb_bidder_rubicon%3Drubicon%26hb_format_s2s_pubmat%3Dbanner%26hb_size_s2s_pubmatic%3D160x600%26hb_pb_s2s_pubmatic%3D0.08%26hb_adid_s2s_pubmatic%3D1332893107f01fb9%26hb_bidder_s2s_pubmat%3Ds2s_pubmatic&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fswxqz.gradientking.com%252F%26tyche_code%3DV.20250515.1%26pageos_code%3DV.20250515.1%26config_id%3D1024872_74068_primary_config%26hour%3D8%26day%3DSaturday%26referrer_domain%3Dswxqz.gradientking.com%26OS%3DLinux%2520null%26browser%3DChrome%2520136%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250515.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D17%252C65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=36793&tan=94373627-d5dd-490a-a651-1f655e2c7617&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.157 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c0ba512a63113abdaa83aa19326f8b711f9d542481f5cbb61b281f05878b923

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 46041
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 9E69 7 KB
3 KB 373ms
120ms Document
text/html 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:46:05 GMT
expires: Sat, 24 May 2025 18:46:05 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 366ms
119ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 24 May 2025 18:46:04 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 219272
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUs-r3n1btq-vjhK2hJozIZ6XN9glQjHGl3dpdkt1FZPJ5xW-Yr_2mliH3p2zHsu4ol4eqJbBEKuZyAOED-RZAxvuOvs3MJ1kbFbOTCHgy-5zqokXcQHoUCP33srqeu4-878VqoMA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-MY3vPdrT7asRjnjQl1VsJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:04 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0pBi-FB_mfUHEJv53Wa1A2IhHo43y08cZBM4cKZ_BbOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLSMzCPLzAAAKLGJ5g"
content-security-policy: script-src 'report-sample' 'nonce-MY3vPdrT7asRjnjQl1VsJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 6D50 2 KB
3 KB 398ms
127ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=12507607&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 954eea4968d88e3f2080ddc1f506a159d491fc6f28075eb985c8c99337c6d334

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUs-r3n1btq-vjhK2hJozIZ6XN9glQjHGl3dpdkt1FZPJ5xW-Yr_2mliH3p2zHsu4ol4eqJbBEKuZyAOED-RZAxvuOvs3MJ1kbFbOTCHgy-5zqokXcQHoUCP33srqeu4-878VqoMA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-hsDD1dWyogKj0DjXBmlZwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1pBi-FB_mfUHEJv53Wa1A2Ihbo63y08cZBPYsXO6lZJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTA1MtIzMI8vMAAAcxsnHQ"
content-security-policy: script-src 'report-sample' 'nonce-hsDD1dWyogKj0DjXBmlZwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUs-r3n1btq-vjhK2hJozIZ6XN9glQjHGl3dpdkt1FZPJ5xW-Yr_2mliH3p2zHsu4ol4eqJbBEKuZyAOED-RZAxvuOvs3MJ1kbFbOTCHgy-5zqokXcQHoUCP33srqeu4-878VqoMA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mMlCK2edkkhqJOtVu0huzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw0ZBi-FB_mfUHEJv53Wa1A2Ihbo63y08cZBP40HLLSsklKb8wPjk_ryQ1r0Q3MaVYF8QuykwqLckvQmGnloFU5OSnp2fmpccbGRiZGpgaGekZmMcXGAAAh20nZA"
content-security-policy: script-src 'report-sample' 'nonce-mMlCK2edkkhqJOtVu0huzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUBktb_s-Ydio8WtyAOv9yyVBvK7zWZUbsqmFmvLlBHbsJYHoqkrYsX8x53pf2POoFFdwjIkEa_wqLbHERB8aFyuTNb_xFQ4vO5QiyMBWm3p9pWzotgfeW8hD30r98vvvK1Cgn0GQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 151ms
151ms Script
application/javascript 142.251.179.100
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUBktb_s-Ydio8WtyAOv9yyVBvK7zWZUbsqmFmvLlBHbsJYHoqkrYsX8x53pf2POoFFdwjIkEa_wqLbHERB8aFyuTNb_xFQ4vO5QiyMBWm3p9pWzotgfeW8hD30r98vvvK1Cgn0GQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4MTEyMzY1LDUwMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5LDZdLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsIm9hSzdhRm9fZi1VIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInN3eHF6LmdyYWRpZW50a2luZy5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

043701708668960a458bf7af260a370d2b37aaa66074bc1be4aeaa33359dc837

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2CrunasdqiKSpCmuZM86uA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:05 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytHikmJw0JBiUAzbydR68xzrZCA2VLjEag_E99ddYn0OxB_qL7P-AOIiiSusDUD8qeoGq0D1DdYk9pusBUAc6niTNRaE026ypgLxmo23WDcDcZP2bdYuIDbzu81qB8RC3Bxvl584yCZw4so0ByWNpPzC-OT8vJKizKTSkvyitOS01OLUorLUongjAyNTA1MjAz0Dg_gCAwBEt0CQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-2CrunasdqiKSpCmuZM86uA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxVAgjMaJuFyFno-KgnheHCcy1uMbXo24Mu0TCSm1Nyiu_rlpvbOSCqUHs-uLtWNxBeCbKXy3hWKhLAVytj2cPuLvGZDf5oFBwpiT-DZfn5_pJzaJjvS_iIZce9ZVKDkHVZW2Dg3fQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 141ms
140ms XHR
text/html 142.251.179.100
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxVAgjMaJuFyFno-KgnheHCcy1uMbXo24Mu0TCSm1Nyiu_rlpvbOSCqUHs-uLtWNxBeCbKXy3hWKhLAVytj2cPuLvGZDf5oFBwpiT-DZfn5_pJzaJjvS_iIZce9ZVKDkHVZW2Dg3fQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.179.100 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PI_s4-d4V8JFwnjU3LnRBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0JBi-FB_mfUHEJv53Wa1A2IhHo63y08cZBM4cObxJEYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSkZ2AeX2AAALN9J9M"
content-security-policy: script-src 'report-sample' 'nonce-PI_s4-d4V8JFwnjU3LnRBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 79B9
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=

35 B
591 B

131ms
130ms

Document
image/gif

185.167.164.38
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.38 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Sat, 24 May 2025 18:46:06 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Sat, 24 May 2025 18:46:05 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 2C74
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

415ms
151ms

Document
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Sat, 24 May 2025 18:46:07 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: Q0Y5ZZQ52Z92WQSNCSPT

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Sat, 24 May 2025 18:46:06 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: D85J15NMQQY5YK6CGAZN

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame CECA
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9164073885411081074&gdpr=0&gdpr_consent=

42 B
447 B

2342ms
1449ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9164073885411081074&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 24 May 2025 18:46:06 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: c8a19815-1f4e-4eb3-80c4-36599fd06712
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Sat, 24 May 2025 18:46:05 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=9164073885411081074&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 9EFE 0
928 B 229ms
152ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 944ef42c2ee27bce-LAX
content-encoding: br
content-type: text/html
date: Sat, 24 May 2025 18:46:05 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112365&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Q2S59goZ2FsNalBGR8OxECRsDChZy5%2F%2B1MXQXeK5SHM%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112365&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=Q2S59goZ2FsNalBGR8OxECRsDChZy5%2F%2B1MXQXeK5SHM%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 6D50
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=eaec0a62-94f1-496c-90b3-7359791c92a3

42 B
320 B

137ms
136ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=eaec0a62-94f1-496c-90b3-7359791c92a3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=eaec0a62-94f1-496c-90b3-7359791c92a3
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:05 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 6D50
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-XKa.ZRNE2pQvZ5dzLKgbGxClCDsa.d9lNg--~A&gdpr=0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=2a6512c95a6b02ace9b2d2853dfddeb1&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=186e36c985d4b0cf
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=146fbc3c-bc7b-4a70-6de6-0f97c0a2d8e6&reqId=8de188b3-c04f-4f8d-5750-e44f03685d28&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=146fbc3c-bc7b-4a70-6de6-0f97c0a2d8e6&reqId=8de188b3-c04f-4f8d-5750-e44f03685d28&zcluid=186e36c985d...

95 B
188 B

225ms
217ms

Image
image/png

2606:4700::6812:1572
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=146fbc3c-bc7b-4a70-6de6-0f97c0a2d8e6&reqId=8de188b3-c04f-4f8d-5750-e44f03685d28&zcluid=186e36c985d4b0cf&zdid=1332&google_error=15

Requested by

Protocol

Server

2606:4700::6812:1572 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 944ef45b68db1024-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Sat, 24 May 2025 18:46:13 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=146fbc3c-bc7b-4a70-6de6-0f97c0a2d8e6&reqId=8de188b3-c04f-4f8d-5750-e44f03685d28&zcluid=186e36c985d4b0cf&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Sat, 24 May 2025 18:46:12 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame 6D50
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=abf4665b-e314-4656-8b61-b74aeac478c3
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=abf4665b-e314-4656-8b61-b74aeac478c3
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=9164073885411081074&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=2929127410558735037&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
151 B

220ms
220ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDIT8wAAFKlCQABa
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748112372.961606,VS0,VE0
age: 406
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/png
x-served-by: cache-mad2200121-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 5

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDIT8wAAFKlCQABa
x-timer: S1748112372.520063,VS0,VE88
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Sat, 24 May 2025 18:46:11 GMT
x-served-by: cache-mad2200121-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NzgwOENCNEMtRENFQy00MzYwLThDQzQtQjVEOURGNkVCM0I0&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

1857ms
1311ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Sat, 24 May 2025 18:46:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 6D50
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=eAjLTNzsQ2CMxLXZ326ztA%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

273ms
265ms

Image
text/html

23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=99634
content-encoding: gzip
expires: Sun, 25 May 2025 22:26:40 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Sat, 24 May 2025 18:46:06 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Sat, 24 May 2025 18:46:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

560ms
277ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Sat, 24 May 2025 18:46:05 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:742FEFB7E53842789E3464BA1CE605DC

42 B
515 B

618ms
276ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:742FEFB7E53842789E3464BA1CE605DC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:742FEFB7E53842789E3464BA1CE605DC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Fri, 23 May 2025 18:46:05 GMT
access-control-allow-origin: *
content-length: 142
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=

42 B
315 B

2731ms
1554ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=
content-length: 355
date: Sat, 24 May 2025 18:46:05 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0qOS1TxE2uXCCMzbQIk4MqRrhC_mZAI-~A&gdpr=0

0
260 B

681ms
129ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0qOS1TxE2uXCCMzbQIk4MqRrhC_mZAI-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:07 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-0qOS1TxE2uXCCMzbQIk4MqRrhC_mZAI-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 24 May 2025 18:46:05 GMT
content-type: text/html
server: ATS

GET
H2 200 7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 6D50 43 B
519 B 640ms
133ms Image
image/gif 2600:1f18:4e9:5a02:ec0b:ea81:df83:916c
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:ec0b:ea81:df83:916c Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Sat, 24 May 2025 18:46:05 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&gdpr=0&gdpr_consent=

1 B
334 B

995ms
994ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: 90795bb9-d049-49d1-9304-a151e60bd505
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 06B0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid...

2 KB
1 KB

92ms
90ms

Document
text/html

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c7810d5a0686a062f65ab9f95ec584c88c25a6afd739e3c2b2a23166cbcac682

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 944ef42f9fb814e8-LAX
content-encoding: br
content-type: text/html
date: Sat, 24 May 2025 18:46:06 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFXJeoLQ8EVy%2BGYsYt5xgo5K8D8ZulJ9bkPod0gfveoyPyY19g%2FfALAWOagWUqIAhIuFmlq8mf9poiuhQpzPzHPgM%2FDWbVgYfIgj5RkZPMOL1zg2%2BYLXjAxxm7mSVZQAgamYA%2BgMwG60qg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 944ef42f0f2b14e8-LAX
content-length: 0
date: Sat, 24 May 2025 18:46:05 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N3b1UkR%2BOzBxuMTcRxmys66k%2FN16z14roi7QUOzqqEiyNaoOkHdDLjaj8fBbaEWNugxL2q89et3RSc2k9%2BH%2FR3WSATe%2FFYAs8kWQ7ysiNHB6BBSlPW9d3LfOBy487W3Hk%2FvO9d6FdjehyA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H3 200 container.html Show response
fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame B9A4 7 KB
0 0ms
0ms Document
text/html 172.253.115.132
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.115.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f132.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:46:05 GMT
expires: Sat, 24 May 2025 18:46:05 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BDA3 52 KB
17 KB 702ms
229ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 38422
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Sat, 24 May 2025 18:46:06 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2611864, 69945
X-Served-By: cache-lga21993-LGA, cache-mad2200140-MAD
X-Timer: S1748112366.367861,VS0,VE0

GET
H2 200 load-cookie.html Show response
elb.the-ozone-project.com/static/ Frame F96E 11 KB
4 KB 680ms
258ms Document
text/html 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b4a064e58197faebd84787537d4d0114f28bdf7820e050f664063527e769a28

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 944ef430fad3100c-LAX
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Sat, 24 May 2025 18:46:06 GMT
expires: 0
last-modified: Tue, 20 May 2025 11:23:41 GMT
pragma: no-cache
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC"
vary: Origin, Accept-Encoding
via: 1.1 google

GET
H2

200

pd Show response
playwire-d.openx.net/w/1.0/ Frame D4F7
Redirect Chain

https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY

803 B
1 KB

96ms
93ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 51e9f57ddd3aeaf7b71888dca813eca3147cb7c93c794f715c31a7e7b9c49165

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Sat, 24 May 2025 18:46:05 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Sat, 24 May 2025 18:46:05 GMT
location: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame A64A 269 B
379 B 404ms
117ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 24 May 2025 18:46:06 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 1791 2 KB
1 KB 384ms
128ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:46:05 GMT
server: Kestrel
server-processing-duration-in-ticks: 83916
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C71B 20 KB
7 KB 128ms
128ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=99635
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Sat, 24 May 2025 18:46:05 GMT
expires: Sun, 25 May 2025 22:26:40 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 2475 3 KB
2 KB 1011ms
362ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 160
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 944ef4327e640fcc-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 24 May 2025 18:46:06 GMT
expires: Sat, 24 May 2025 22:46:06 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 0AD4 0
0 859ms
323ms Document
text/plain 206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Sat, 24 May 2025 18:46:06 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 286E 1 KB
2 KB 359ms
139ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 004c4bf06d53df5ee8fe11c3017c5fff14a2c35e55497ae67207eba499a92383

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Sat, 24 May 2025 18:46:06 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 544ms
542ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=B-rTDV9VaVRIMVhxbXRaMk9JTnh3eng1NUM5dGVMRzZWVEhiY3phVkxqZDBKaVNCRGF2cHhhJTJGUUNJZ3ZDZiUyRkJoNnJGMWg5TEQ4RmdLQXpWTWlZZ29tazlZVHh2RWlCdkJONGpKWDRVbnNKQTBONFNuREdPQ0w1NUwlMkZEaGFicHU5T01sUw&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sat, 24 May 2025 18:46:04 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 315733
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 215ms
214ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:05 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
663 B 139ms
139ms Fetch
application/javascript 52.200.238.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.238.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-238-32.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 904afbd88ed335524bc5649bdf7fd554390755765e55ff085aca0bd7bf3112e7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 24 May 2025 18:46:05 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 92ms
89ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.36.0&coppa=0&us_privacy=1NNY&tp=3%2BTVNDgirJN9AcFWlN%2F0fHPyYd3LfV%2Fzq1YhOgiA83g%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: b9e3b2cd022a4f80f464c85093398adce2ee660338b4df9960d4c507ba29def0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Sat, 24 May 2025 18:46:05 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
0 2ms
1ms Fetch
text/plain 54.225.240.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jw1svjrp23rtvxdz4djz4cwd&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.240.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-240-34.compute-1.amazonaws.com
Software: /
Resource Hash: e8640e7d9f894029a14912a589c9279214b13d7474289e9c8a11d28918cfcb45

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 7405d8239d76d356
request-time: 9
access-control-allow-credentials: true
expires: Sun, 25 May 2025 18:46:03 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Sat, 24 May 2025 18:46:03 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 130ms
127ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 278642
expires: 0
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:06 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H3

200

receive
pixel.tapad.com/idsync/ex/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YWJmNDY2NWItZTMxNC00NjU2LThiNjEtYjc0YWVhYzQ3OGMz&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74ae...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3&google_error=15
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dtapad
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&partner_url=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3...
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%252Chttps%2525...
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=9164073885411081074&pt=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2Chttps%253A%252F%252Fmatch.adsrvr.org%252Ftrack%252Fcmf%...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&ttd_puid=
https://dpm.demdex.net/ibs:dpid=540&dpuuid=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=22234770664686421271851641561609857156&pt=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C

95 B
124 B

98ms
98ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=22234770664686421271851641561609857156&pt=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=22234770664686421271851641561609857156&pt=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C
dcs: dcs-prod-va6-2-v076-0bf8ebcd8.edge-va6.demdex.com 5 ms
pragma: no-cache
x-tid: nuGU10HZQUA=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Sat, 24 May 2025 18:46:08 GMT

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 687ms
341ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 263ms
131ms Fetch
text/html 142.251.111.154
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.111.154 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f154.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 90A0 652 B
254 B 387ms
136ms Document
text/html 172.253.122.156
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARjM4-u5AjAB&v=APEucNXc0XtsjL7VNB9L0mHP-ag5CGW5MVClOhK560OiX-AsaesgfG-nUa98FK486Zi3fqsVZa3ek0Fnpp3cXPovY6WVpoYVOTWz0JAazhUtcz9kLzYUlyw

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:46:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame B9A4 477 KB
96 KB 854ms
563ms Script
text/javascript 2600:1408:5400:23::b819:7f4b
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: swxqz.gradientking.com
URL: https://swxqz.gradientking.com/e83waa275ldr74jwxx8lge9uRNXVPRW1UT3FqRVZOU1lZclRqbVItMzEyNy0yNjcyMTAzMS0wZmE3MDI2NC00Nzk5LXhBQ2IxV0FiVHUwdTZZOUxrTE9h/nfvfa5u4lp7/0C5S6sCn3EnOkA/111899987808844978348674748555947
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:23::b819:7f4b Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 7a5311755b6acbc4a85a705a6309c0f178f27270aedf665303cea44f51e304b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "cf0f10366b0f49a4cb1227f621ef359f"
Connection: keep-alive
Expires: Sat, 24 May 2025 19:01:06 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 97521
Date: Sat, 24 May 2025 18:46:06 GMT
Last-Modified: Wed, 21 May 2025 12:49:28 GMT
Content-Type: text/javascript

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame B9A4 117 KB
41 KB 378ms
123ms Script
text/javascript 2607:f8b0:4004:c09::95
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::95 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 21534
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sun, 25 May 2025 12:47:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 12:47:12 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/elements/html/ Frame B9A4 8 KB
3 KB 751ms
498ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 567199331036499589
age: 16831
x-content-type-options: nosniff
expires: Sat, 07 Jun 2025 14:05:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 14:05:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/ Frame B9A4 21 KB
8 KB 741ms
497ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250521/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be507b359cc4919d2c1154e11c9d17b94ba03bc583f0d31fffc3525583bec00d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 5251608839672234903
age: 16831
x-content-type-options: nosniff
expires: Sat, 07 Jun 2025 14:05:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 14:05:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8642
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame B9A4 41 KB
14 KB 816ms
554ms Script
text/javascript 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2598
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:52:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:02:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/ Frame B9A4 3 KB
1 KB 816ms
554ms Script
text/javascript 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/window_focus_fy2021.js

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 10722
x-content-type-options: nosniff
expires: Sat, 07 Jun 2025 15:47:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 15:47:24 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A2D5 1 KB
643 B 373ms
132ms Document
text/html 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 67813
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 23 May 2025 23:55:53 GMT
etag: 48472445140208031
expires: Sat, 24 May 2025 23:55:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/ Frame B9A4 19 KB
8 KB 812ms
553ms Script
text/javascript 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250521/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

760e5d0b97d6707a3d5c2c949bd70e7668484a144f383f3a4dfa878bad15e8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 3000748235154339481
age: 10722
x-content-type-options: nosniff
expires: Sat, 07 Jun 2025 15:47:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 15:47:24 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9A4 42 B
63 B 636ms
397ms Image
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CfT0zi9c60i7tUviJkQQfhVcoIKU58xuYbpcHvvxTyMDETubOXCl-fpQnYz5sh9MLrcMbRRpXrlYo7dSmDPifwlxb2zKlJfk53peNSMiPyh5TdJ-U

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET l
www.google.com/ads/measurement/ Frame B9A4 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame B9A4 221 KB
68 KB 373ms
135ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31532337.ip-162-19-138.eu

Software

cafe /

Resource Hash

9fc89654aff6bca6c890b30bd0833eb2f18d63a61c0a9ece5246537ad6f73c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 81102085050987160
age: 1384
x-content-type-options: nosniff
expires: Sat, 24 May 2025 19:23:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Sat, 24 May 2025 18:23:02 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69707
x-xss-protection: 0
server: cafe

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 919ms
919ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

87cdc23eac75fd506d4573162c33781ccdf43d967dd5f59a4d51d5e8a80f0447

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Sat, 24 May 2025 18:46:06 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 06B0
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDIT7cAoIkgACXymAeSeuAAAB-cAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDIT7cAoIkgACXymAeSeuAAAB-cAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

146ms
145ms

Image
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDIT7cAoIkgACXymAeSeuAAAB-cAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1

Protocol

HTTP/1.1

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: C5QF35GM8GMB92YE9S18
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDIT7cAoIkgACXymAeSeuAAAB-cAAAAB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: EQ0NJ0JJZ5DCY72P27ZR
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 24 May 2025 18:46:06 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 06B0
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

683ms
130ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Sat, 24 May 2025 18:46:08 GMT
server: Kestrel

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 06B0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDIT7cAoIkgACXymAeSeuAAA

170 B
232 B

291ms
290ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDIT7cAoIkgACXymAeSeuAAA

Requested by

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tWDlBsAdl614Lc8aRWrViXm0vG5polseUvtuETBbgUNkLZYnj%2FgoCCyjSQLCxj0GUNoWqH55XpPc2c%2FHeq8CdLgf%2BDHyGyzpxnS1B0aMb37kL0u611L2nueEXDNAdbWv0IQlbbBMW%2B0dXA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:06 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDIT7cAoIkgACXymAeSeuAAA
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef430d9d70926-LAX
content-length: 0
server: cloudflare

GET
H2

200

sync
thrtle.com/ Frame 06B0
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aDIT7cAoIkgACXymAeSeuAAA%262023&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=b1613b8c-75f8-4b5a-924f-d9df250f0f3e&us_privacy=1YN-&us_privacy=1NNY
https://thrtle.com/sync?_reach=1&vxii_pdid=b1613b8c-75f8-4b5a-924f-d9df250f0f3e&vxii_pid=12&vxii_pid1=7006&vxii_rcid=04164df4-c5db-4549-a4ae-5525f9168253&vxii_rmax=3
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748112368%26_reach%3D1
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=9164073885411081074&vxii_ts=1&_t=1748112368&_reach=1
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A

43 B
538 B

131ms
131ms

Image
image/gif

54.158.211.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Server: 54.158.211.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-211-207.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/html
server: ATS

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 06B0
Redirect Chain

https://trace.mediago.io/ju/cs/indexexchange
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=06b4a7e63ec854c92grcb100mb2kyv5t

43 B
763 B

101ms
101ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=06b4a7e63ec854c92grcb100mb2kyv5t
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=atVnXEx9Ea5FnVydRT80IVlj3trvftb24Ttc1LrZMhYoeFZlvSjAbCKRH1ypFrckSq916vvNDDt%2FPnDCncbQLBMlHEwZDAeAvCQ3IVYiVv1R6B63YL6lLjnREJzGTFVZdlbBXTSx9Zm%2BTg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef437b9f20926-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=215&external_user_id=06b4a7e63ec854c92grcb100mb2kyv5t
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8
date: Sat, 24 May 2025 18:46:07 GMT
content-type: text/plain; charset=utf-8
access-control-allow-headers: Content-Type

GET
H3

200

rum
dsum.casalemedia.com/ Frame 06B0
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1&us_privacy=1NNY
https://casale-match.dotomi.com/match/bounce/current?DotomiTest=70674bf81856140a&is_secure=true&networkId=19998&version=1&us_privacy=1NNY
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQAHs5CEHleycgJE3vlOAQEBAQEBAQCWApze-gEBAQEBAQEB&expiration=1748198767&is_secure=true&us_privacy=1NNY

43 B
793 B

107ms
106ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQAHs5CEHleycgJE3vlOAQEBAQEBAQCWApze-gEBAQEBAQEB&expiration=1748198767&is_secure=true&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dFdYWUaTZ8oAZmc6AFmZYxUlZQ8BTTILi%2BIE7geMWsN6D8qxKpJTtaExX9K9HPF3iZq9Ns9bcXEJJ3DV%2FAaNlec6S%2FtCZ%2Br1RRVXZeYNBf%2FtDNMWv4DctBuo6Y81D3yIhfqnVDVy"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef43a2e8bf79a-LAX
content-length: 43
server: cloudflare

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AQAHs5CEHleycgJE3vlOAQEBAQEBAQCWApze-gEBAQEBAQEB&expiration=1748198767&is_secure=true&us_privacy=1NNY
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
pragma: no-cache
server: nginx

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 06B0
Redirect Chain

https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=1NNY&gdpr=&gdpr_consent=&gpp=&gpp_sid=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=167bc78e-977f-40fa-a8f4-3ee23d7ef61f&gpp_sid=null&gpp=null&us_privacy=1NNY&gdpr_consent=null&gdpr=null

43 B
770 B

91ms
90ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=167bc78e-977f-40fa-a8f4-3ee23d7ef61f&gpp_sid=null&gpp=null&us_privacy=1NNY&gdpr_consent=null&gdpr=null
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tGsGrhIaYy%2FAU1PqC2q6G3ibNYz7VoExFsr2RZSACl2yq7vPmTid%2Bily2%2FhkX3q3BCmO5XcY%2BTD4J8Lc4Oq4H1%2FOXEKHZtHXXj9Aih1jJglmM%2B4B5MpLpj3FWj%2FFY3BqzRt7UkBydXcIuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef4346de40926-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=167bc78e-977f-40fa-a8f4-3ee23d7ef61f&gpp_sid=null&gpp=null&us_privacy=1NNY&gdpr_consent=null&gdpr=null
content-length: 0
date: Sat, 24 May 2025 18:46:06 GMT
server: _

GET
H2

200

crum
dsum.casalemedia.com/ Frame 06B0
Redirect Chain

https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1&us_privacy=1NNY
https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=e0d7ce47-c2f1-47aa-9e0a-797bc4adf379

43 B
552 B

84ms
82ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=e0d7ce47-c2f1-47aa-9e0a-797bc4adf379
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ndJtFLAVb6ISf3kJ%2F0RyIpaorMIOXLpZOXtlRgpXwquuNyQEMMjuQ%2F8oYr2q0M%2FGeT613%2FwU5c9hp%2Biet3WWr7WVko8SBzQmqTI2knS4c1ldlUGt%2FCqeVjHq79p6F1YNhI2Zjl3v"}],"group":"cf-nel","max_age":604800}
cf-ray: 944ef438e8d114e8-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000;
cache-control: private,no-cache
location: https://dsum.casalemedia.com/crum?cm_dsp_id=156&external_user_id=e0d7ce47-c2f1-47aa-9e0a-797bc4adf379
x-servername: Track004-iad
pragma: no-cache
expires: -1
content-length: 222
date: Sat, 24 May 2025 18:46:28 GMT
content-type: text/html; charset=utf-8

GET
H3 200 setuid
prebid.intergient.com/ Frame 06B0 0
986 B 166ms
164ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aDIT7cAoIkgACXymAeSeuAAA%262023
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112366&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=EF2hViPX5xz5FLTaqQweV9FoEiwsrdnniRhHBvG7o7Y%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 24 May 2025 18:46:06 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112366&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=EF2hViPX5xz5FLTaqQweV9FoEiwsrdnniRhHBvG7o7Y%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944ef4305a487bce-LAX
server: cloudflare

GET
H2

200

xuid
eb2.3lift.com/ Frame 286E
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=abf4665b-e314-4656-8b61-b74aeac478c3&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

215ms
215ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=abf4665b-e314-4656-8b61-b74aeac478c3&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=abf4665b-e314-4656-8b61-b74aeac478c3&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Sat, 24 May 2025 18:46:06 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 286E 170 B
243 B 164ms
163ms Image
image/png 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 286E
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D

170 B
232 B

331ms
330ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:06 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 286E
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

139ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 286E 0
248 B 828ms
362ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4176077111496352796998&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 189AC596E9ED42B399537390C22147EC Ref B: LAX311000114049 Ref C: 2025-05-24T18:46:06Z
x-li-fabric: prod-lva1
x-li-uuid: AAY15iCl9BAnUPRzipzQMA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 24 May 2025 18:46:05 GMT

GET
H2

200

sync
thrtle.com/ Frame 286E
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4176077111496352796998
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=b1613b8c-75f8-4b5a-924f-d9df250f0f3e&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=b1613b8c-75f8-4b5a-924f-d9df250f0f3e&vxii_pid=12&vxii_pid1=7006&vxii_rcid=5b5ab50e-5c64-415b-b959-0f794fda07fc&vxii_rmax=3
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D1%26_t%3D1748112368%26_reach%3D1
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=9164073885411081074&vxii_ts=1&_t=1748112368&_reach=1
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A

43 B
538 B

129ms
129ms

Image
image/gif

54.158.211.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 54.158.211.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-211-207.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-K3e5l7RE2oSZTjW.gRFnFJU7JMv8JCvp9Y4_uw--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame 286E
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4176077111496352796998?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-RzXbN9JE2oQZ6RRsiVEp_loO23QZlhHo._AI5m5FkQ--~A&dongle=0883

37 B
474 B

260ms
259ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-RzXbN9JE2oQZ6RRsiVEp_loO23QZlhHo._AI5m5FkQ--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-RzXbN9JE2oQZ6RRsiVEp_loO23QZlhHo._AI5m5FkQ--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 24 May 2025 18:46:06 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 286E 42 B
690 B 791ms
109ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4176077111496352796998&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: B0E8E227838F42D2A2AF55D1AF1C63BD Ref B: LAX311000112045 Ref C: 2025-05-24T18:46:06Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 286E
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=1079ecbc16831272&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGDIWUnyujOQJyjfUlAQEBAQEBAQCWApzfPwEBAQEBAQEB&expiration=1748198767&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

145ms
144ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGDIWUnyujOQJyjfUlAQEBAQEBAQCWApzfPwEBAQEBAQEB&expiration=1748198767&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAGDIWUnyujOQJyjfUlAQEBAQEBAQCWApzfPwEBAQEBAQEB&expiration=1748198767&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 286E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430

37 B
474 B

142ms
142ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Content-Length: 141
Date: Sat, 24 May 2025 18:46:06 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame D4F7 170 B
232 B 163ms
161ms Image
image/png 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame D4F7 170 B
232 B 393ms
391ms Image
image/png 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=OTM0NWE2Y2UtOTBjMS0yMWE4LWRhMmEtYTkxMzhhNjUzZDFi

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

google
match.adsrvr.org/track/cmf/ Frame D4F7
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=bf2a7504-59b6-7f0c-cfca-f3aa4087f37b&gdpr=0
https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3
https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=9164073885411081074&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=YWJmNDY2NWItZTMxNC00NjU2LThiNjEtYjc0YWVhYzQ3OGMz&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74ae...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3&google_error=15

70 B
504 B

93ms
92ms

Image
image/gif

35.71.131.137
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3&google_error=15
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
Protocol: H2
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

content-length: 70
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=abf4665b-e314-4656-8b61-b74aeac478c3&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 345
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D4F7
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/2bed1340-c91a-ed45-fe1d-e55fbfd03e32?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-d7A_TQFE2p9xmNzRQPXJY6LoG2.71xq0bN8-~A

43 B
61 B

270ms
270ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-d7A_TQFE2p9xmNzRQPXJY6LoG2.71xq0bN8-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-d7A_TQFE2p9xmNzRQPXJY6LoG2.71xq0bN8-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 24 May 2025 18:46:06 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame D4F7
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDIT8AATRggPTwAL

85 B
171 B

454ms
454ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDIT8AATRggPTwAL
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
Protocol: H2
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748112369.570804,VS0,VE0
age: 2373
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
x-served-by: cache-mad2200121-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 9374

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDIT8AATRggPTwAL
x-timer: S1748112368.257135,VS0,VE88
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
x-served-by: cache-mad2200121-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame D4F7
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

90ms
90ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?cc=1&us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 24 May 2025 18:46:18 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame A64A 44 KB
11 KB 475ms
468ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 5e30418c1494afb63c9670a618886b6fb00e398b504cbdcd5a2cea9f14571f4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=60677
content-encoding: gzip
expires: Sun, 25 May 2025 11:37:23 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Sat, 24 May 2025 18:46:06 GMT
last-modified: Sat, 24 May 2025 11:37:23 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 90A0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0

43 B
766 B

96ms
96ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARjM4-u5AjAB&v=APEucNXc0XtsjL7VNB9L0mHP-ag5CGW5MVClOhK560OiX-AsaesgfG-nUa98FK486Zi3fqsVZa3ek0Fnpp3cXPovY6WVpoYVOTWz0JAazhUtcz9kLzYUlyw
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c7y48%2F%2BDS1zLvFSUUUFgD7DHRPrKzWhqm7fie1u%2FduIhAsoXJpygUSCaDQNvumgDTFrHBkaO2HBoa%2FOFgz7C7etYEpWR4klbS1lZwGD8NNPQshN%2BYjZ17TLatxUcrPfw9LLnbJmLXVvUGg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef4338cc50926-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 90A0
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aDIT7cAoIkgACXymAeSeuAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
764 B

102ms
102ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARjM4-u5AjAB&v=APEucNXc0XtsjL7VNB9L0mHP-ag5CGW5MVClOhK560OiX-AsaesgfG-nUa98FK486Zi3fqsVZa3ek0Fnpp3cXPovY6WVpoYVOTWz0JAazhUtcz9kLzYUlyw
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tCtFwLqShacApKfW5BMxzK8bobRHg00jMaa0%2B%2Bf2Eyiq1ebl9T4e%2F7bUVDaRVkgtaXtnF%2B5nK9iT70FF45d5YCqViKOSkfvAxzEXNhgypWmb7se1H4Wwq5gVRAQYoXx%2Bkg2wHBoADRxwPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Sat, 24 May 2025 18:46:06 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 944ef4357f300926-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 90A0 170 B
232 B 323ms
320ms Image
image/png 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARjM4-u5AjAB&v=APEucNXc0XtsjL7VNB9L0mHP-ag5CGW5MVClOhK560OiX-AsaesgfG-nUa98FK486Zi3fqsVZa3ek0Fnpp3cXPovY6WVpoYVOTWz0JAazhUtcz9kLzYUlyw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 90A0
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE2NDA3Mzg4NTQxMTA4MTA3NA%3D%3D&gdpr=0

170 B
188 B

141ms
141ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE2NDA3Mzg4NTQxMTA4MTA3NA%3D%3D&gdpr=0

Requested by

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTE2NDA3Mzg4NTQxMTA4MTA3NA%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fcd6476e-d6b2-44b9-b3b2-87d197ad766c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_push=AXcoOmQdabTEgnSeyWuHrTNhfntYmZE_NCuv38XjV3um_OPpPegY65n9jrMlUSMBB4JsAUJMV1UAQ_HkIaSYTv4e3YCx1ziC_B-jUFXR4rRl...
https://dclk-match.dotomi.com/match/bounce/current?DotomiTest=55288c2b3f106ec&is_secure=true&networkId=14000&version=1&google_push=AXcoOmQdabTEgnSeyWuHrTNhfntYmZE_NCuv38XjV3um_OPpPegY65n9jrMlUSMBB4...
https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAA-0teL5iI4QIJ9Of5AQEBAQEBAQCWApzfSQEBAQEBAQEB&expiration=1748198767&is_secure=true&google_push=AXcoOmQdabTEgnSey...

170 B
188 B

138ms
137ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAA-0teL5iI4QIJ9Of5AQEBAQEBAQCWApzfSQEBAQEBAQEB&expiration=1748198767&is_secure=true&google_push=AXcoOmQdabTEgnSeyWuHrTNhfntYmZE_NCuv38XjV3um_OPpPegY65n9jrMlUSMBB4JsAUJMV1UAQ_HkIaSYTv4e3YCx1ziC_B-jUFXR4rRlUqoshj1vrJd8V9ukcJTs-IPbuHr2z4vqaGN8

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=dotomi&google_ula=17128,0&google_hm=AQAA-0teL5iI4QIJ9Of5AQEBAQEBAQCWApzfSQEBAQEBAQEB&expiration=1748198767&is_secure=true&google_push=AXcoOmQdabTEgnSeyWuHrTNhfntYmZE_NCuv38XjV3um_OPpPegY65n9jrMlUSMBB4JsAUJMV1UAQ_HkIaSYTv4e3YCx1ziC_B-jUFXR4rRlUqoshj1vrJd8V9ukcJTs-IPbuHr2z4vqaGN8
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
pragma: no-cache
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://aep.mxptint.net/sn.ashx?google_push=AXcoOmT3OKd2pKcye9recuRNMoXY0BAtxzvov7oeq8hOAe0rWMRu_RMgIjDokUu-LtgTpWumEe3aPZ-QsZ153_pe0KO37ez93tnWtYAGXyj-xTIdyLLsZvvnXMCr8T3wxxrR8mT7URU3SlEL
https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmT3OKd2pKcye9recuRNMoXY0BAtxzvov7oeq8hOAe0rWMRu_RMgIjDokUu-LtgTpWumEe3aPZ-QsZ153_pe0KO37ez93tnWtYAGXyj-xTIdyLLsZvvnXMCr8T3...

170 B
188 B

139ms
139ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmT3OKd2pKcye9recuRNMoXY0BAtxzvov7oeq8hOAe0rWMRu_RMgIjDokUu-LtgTpWumEe3aPZ-QsZ153_pe0KO37ez93tnWtYAGXyj-xTIdyLLsZvvnXMCr8T3wxxrR8mT7URU3SlEL&google_hm=UjUwMTQxXzEyOEQ1MENBQl8xMDQ0MUJBMEZC

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Strict-Transport-Security: max-age=-431117166; includeSubDomains
Location: https://cm.g.doubleclick.net/pixel?google_nid=pf8b3zh4kyw&google_push=AXcoOmT3OKd2pKcye9recuRNMoXY0BAtxzvov7oeq8hOAe0rWMRu_RMgIjDokUu-LtgTpWumEe3aPZ-QsZ153_pe0KO37ez93tnWtYAGXyj-xTIdyLLsZvvnXMCr8T3wxxrR8mT7URU3SlEL&google_hm=UjUwMTQxXzEyOEQ1MENBQl8xMDQ0MUJBMEZC
Content-Length: 0
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Date: Sat, 24 May 2025 18:46:05 GMT
Server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJifjLxfX1...
https://b1sync.outbrain.com/usersync/googleadx/?google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJifjLxfX...
https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJifjLxfX1...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJi...

170 B
188 B

137ms
136ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJifjLxfX1jRUjC9&google_hm=MTVkZjFkN2QtNTNjNS00MzcyLWJlNTMtYjNjOTViNTNiNTQy

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRbxUpixLWaMGwUbpaFTLIlxqlmpRoZntrL5ddf91r8JkJbMNmWZKNImDMMMdjaDOfGqnh5gDVU1eAH3JJSfCViis4321Dbh0GICXGZv6NdRnGSQ2cvgckWNqV_LJifjLxfX1jRUjC9&google_hm=MTVkZjFkN2QtNTNjNS00MzcyLWJlNTMtYjNjOTViNTNiNTQy
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 300
date: Sat, 24 May 2025 18:46:07 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_push=AXcoOmSwoE8po02uaUGEGlxviudlkqiLfRBw5IkB8mE7MLrRPE9boeUwj775p3YP_aaItArTtnoPSsJppUz_8tR-44NC-yLJc1rpQyIZ7NzBQJx2ve6wb-4ZwRGKuqBa-q8AQVdZ6vDD778
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=qjqjgpAhWFVWkYkPD5nQCKL1zvk&google_push=AXcoOmSwoE8po02uaUGEGlxviudlkqiLfRBw5IkB8mE7MLrRPE9boeUwj775p3YP_aaItArTtnoPSsJppUz_8t...

170 B
188 B

140ms
139ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=qjqjgpAhWFVWkYkPD5nQCKL1zvk&google_push=AXcoOmSwoE8po02uaUGEGlxviudlkqiLfRBw5IkB8mE7MLrRPE9boeUwj775p3YP_aaItArTtnoPSsJppUz_8tR-44NC-yLJc1rpQyIZ7NzBQJx2ve6wb-4ZwRGKuqBa-q8AQVdZ6vDD778

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=qjqjgpAhWFVWkYkPD5nQCKL1zvk&google_push=AXcoOmSwoE8po02uaUGEGlxviudlkqiLfRBw5IkB8mE7MLrRPE9boeUwj775p3YP_aaItArTtnoPSsJppUz_8tR-44NC-yLJc1rpQyIZ7NzBQJx2ve6wb-4ZwRGKuqBa-q8AQVdZ6vDD778
Content-Length: 285
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_push=AXcoOmQAEEHN4g8IRTVRHXdYHZ0DxrQ9UNokQumDUSKlIE_Yy4KPD44HfpvdeJZg5CV5gk-M_zOoCuccxkU5ZG7XH56bZV8ykBVz89QUNFYjGyh5U6cODdJoHWwJNW0cb9VdPRQp6HK1qV2A
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D&google_push=AXcoOmQAEEHN4g8IRTVRHXdYHZ0DxrQ9UNokQumDUSKlIE_Yy4KPD44H...

170 B
188 B

137ms
136ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D&google_push=AXcoOmQAEEHN4g8IRTVRHXdYHZ0DxrQ9UNokQumDUSKlIE_Yy4KPD44HfpvdeJZg5CV5gk-M_zOoCuccxkU5ZG7XH56bZV8ykBVz89QUNFYjGyh5U6cODdJoHWwJNW0cb9VdPRQp6HK1qV2A

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDE3NjA3NzExMTQ5NjM1Mjc5Njk5OA%3D%3D&google_push=AXcoOmQAEEHN4g8IRTVRHXdYHZ0DxrQ9UNokQumDUSKlIE_Yy4KPD44HfpvdeJZg5CV5gk-M_zOoCuccxkU5ZG7XH56bZV8ykBVz89QUNFYjGyh5U6cODdJoHWwJNW0cb9VdPRQp6HK1qV2A
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Sat, 24 May 2025 18:46:06 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_push=AXcoOmTnth7SAotuRMQ0dW4QnEa2BSKzroujIa3gb5XJjV1MF8GFBPj3Vdw6LOt4VgjbQCUzpt2IIhL5QMPrsKHGMX1-M3TXYEIu6tnddQ4-M2cnZljD39irQk916uCIi...
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_push=AXcoOmTnth7SAotuRMQ0dW4QnEa2BSKzroujIa3gb5XJjV1MF8GFBPj3Vdw6LOt4VgjbQCUzpt2IIhL5QMPrsKHGMX1-M3TXYEIu6tnddQ4-M2cnZljD39irQk9...
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=v835R3jPSHuWwWOn6mmaFQ==&no_redirect=1&google_push=AXcoOmTnth7SAotuRMQ0dW4QnEa2BSKzroujIa3gb5XJjV1MF8GFBP...

170 B
188 B

141ms
141ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=v835R3jPSHuWwWOn6mmaFQ==&no_redirect=1&google_push=AXcoOmTnth7SAotuRMQ0dW4QnEa2BSKzroujIa3gb5XJjV1MF8GFBPj3Vdw6LOt4VgjbQCUzpt2IIhL5QMPrsKHGMX1-M3TXYEIu6tnddQ4-M2cnZljD39irQk916uCIip8sUIv5eLAoxfBF

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=v835R3jPSHuWwWOn6mmaFQ==&no_redirect=1&google_push=AXcoOmTnth7SAotuRMQ0dW4QnEa2BSKzroujIa3gb5XJjV1MF8GFBPj3Vdw6LOt4VgjbQCUzpt2IIhL5QMPrsKHGMX1-M3TXYEIu6tnddQ4-M2cnZljD39irQk916uCIip8sUIv5eLAoxfBF
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:07 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A2D5
Redirect Chain

https://www.temu.com/api/adx/cm/pixel-google?google_push=AXcoOmSmpYKLsJFd4ynMDr7fhmmAyqeGt9e6JkhwP4snjhZ0VomdclFRTDQjhapVOBBj-ObhGjj4y5rwn22tE6QxEql_gJFcBzTrJxQVmF3tc9G8Rxw5piUk2rP0P3Y0EOKFS8lWmqPM...
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSmpYKLsJFd4ynMDr7fhmmAyqeGt9e6JkhwP4snjhZ0VomdclFRTDQjhapVOBBj-ObhGjj4y5rwn22tE6QxEql_gJFcBzTrJxQVmF3tc9G8Rxw5piUk2rP0P3Y0EOKFS8lWmqPMsU3S_w&goo...

170 B
188 B

148ms
148ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSmpYKLsJFd4ynMDr7fhmmAyqeGt9e6JkhwP4snjhZ0VomdclFRTDQjhapVOBBj-ObhGjj4y5rwn22tE6QxEql_gJFcBzTrJxQVmF3tc9G8Rxw5piUk2rP0P3Y0EOKFS8lWmqPMsU3S_w&google_nid=temu_dsp2_

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1748112366822|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmSmpYKLsJFd4ynMDr7fhmmAyqeGt9e6JkhwP4snjhZ0VomdclFRTDQjhapVOBBj-ObhGjj4y5rwn22tE6QxEql_gJFcBzTrJxQVmF3tc9G8Rxw5piUk2rP0P3Y0EOKFS8lWmqPMsU3S_w&google_nid=temu_dsp2_
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1748112366822-29d1f0198ee3c5012bc5f0b155436f8b-20
cip: 162.245.206.249
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Sat, 24 May 2025 18:46:06 GMT
server: nginx

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame A2D5 0
59 B 260ms
259ms Image
text/html 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IhGp-BCx-u1qcqzC3E6TEjTAMdoi0XT9xn1hjTwiw7TIcfHVt-NvLWeXjlX-eiFhDnAJ71VUc

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 24 May 2025 18:46:06 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame F96E 19 KB
7 KB 304ms
151ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://elb.the-ozone-project.com
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 944ef4342f1408f4-LAX
access-control-allow-origin: *
date: Sat, 24 May 2025 18:46:06 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 cookie_sync Show response
elb.the-ozone-project.com/ Frame F96E 4 KB
1 KB 146ms
145ms XHR
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/cookie_sync
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 838b66650adcdbbcaacfa7edc238263b556176a9fff8f04278ec485314ba8239

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 944ef4333d99100c-LAX
expires: 0
access-control-allow-origin: https://elb.the-ozone-project.com
date: Sat, 24 May 2025 18:46:06 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0FE4 38 KB
13 KB 122ms
119ms Document
text/html 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 691
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 18:34:35 GMT
expires: Sat, 24 May 2025 19:24:35 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame B9A4 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f7e5e34b8ed77ef67a7dcbdd0791973318ecb927ea9c0a292ab1b90fd14053a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame F96E
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&redir=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dunruly%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3Dpb...
https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT

0
290 B

233ms
232ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 944ef436fa30100c-LAX
expires: 0
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://elb.the-ozone-project.com/setuid?bidder=unruly&gdpr=0&gdpr_consent=&us_privacy=pbs-ozone&uid=OPTOUT
date: Sat, 24 May 2025 18:46:07 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame B3BE 0
412 B 401ms
125ms Document
text/html 44.199.0.179
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.199.0.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-199-0-179.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 819 B
1 KB 211ms
210ms Fetch
application/json 162.19.138.117
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

8693fa747d4508398baff09474b4051f0b0a8798a214c62bd0a93c40942ba2b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: application/json
vary: Origin

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9A4 0
0 137ms
136ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9A4 0
0 135ms
135ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9A4 0
0 137ms
136ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js Show response
pagead2.googlesyndication.com/bg/ Frame 0FE4 54 KB
20 KB 125ms
125ms Script
text/javascript 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7d95cc67d98bc416e14f07dd01cd82ad75f812b2f494233c19a71236b22a1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 194910
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Fri, 22 May 2026 12:37:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 22 May 2025 12:37:37 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20818
x-xss-protection: 0
server: sffe

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 188E 4 KB
5 KB 136ms
135ms Document
text/html 206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 1ad446ecad9f86f7b6c207cd8010e0d0bc32731618126f07e71a2cf7c00c4342

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4157
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame B9A4 451 B
583 B 315ms
135ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=12268837&cmp=32905093&sid=8602117&plc=421641522&crt=234229028&advid=5925338&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&aucmp=22561170956&auevent=ABAjH0jhO7WWL6Ln7CLFODxkTa2T&autt=1&ppid=103&aucrtv=658174412&auorder=1021271876&pltfrm=1&ausite=1995081996404&auxch=1&aufilter1=2765340&c1=2765340&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&brh=2&vavbkt=&lvvn=28&fcifrms=23&winh=600&winw=160&chro=1&noc=16&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7821&uid=1748112367270353&srcurlD=0&ttfrms=58&num=6&dvp_isOnHead=0&flvr=1&ver=7821&jsCallback=__verify_callback_1748112367270353&jsTagObjCallback=__tagObject_callback_1748112367270353&ssl=1&prndr=1&m1=96&blkmode=2&ee_dp_rdystreq=interactive&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=125166525893.44614&ee_dp_sukv=125166525893.44614&dvp_tukv=26333125.657089885&ee_dp_tukv=26333125.657089885&dvp_strhd=0.5&dvpx_strhd=0.5&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTau74_d5g_g6hd_26bh2gg_abb7c_7fgged%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&referrer=https%3A%2F%2Ffc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: ebc2050088a3db7feea2d7a2cf6442ac1d91a9f3327bcaa9ba5ac26a0c075d29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 0
Expires: 05/23/2025 18:46:07
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame B9A4 0
0 282ms
144ms Fetch
image/png 142.251.163.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst1IOf5cQq_giwsmarPehxM3ix0jJzCfg2RRkh0-2ms4_vaGLvnXphsoJ8wI6KNjb2Hk7VU5NC6X6yUbubcWTlDpZKLFLN4rOtI_AVkqaCo69D3saU1aSpMxpVrv2Z67xzNP_uY-FaedYw3VLE39ppfVoNJa17HlQ6rnW-fEVtvymrmSrcnbzs1u7hnARlKjkoVQ5YfdrqgpXX54SUvGC32E0xK8V05srky1CLLpuEGeabhluKEfMVh4_oiTgFTlVjYn76i26KSVrMjMGHB2TYzLjg12gPfTCeQ0o6uzYA8OvxOJwQPTtQT-KE2cVczi4r3RxRRvySN0JmA0oHR_OSiS2wQqMTQeEYuJfxb0xsdfoZVQIJjtTi6nHLbsz67QP-VTTVGAmFmtVUGktKng7g48XMklCOlZhl59_DiGkkDMudmGolWDQvPLE16Qgez5BvZygk2R6YRWK037Ee_m4ms8tGGkLeD770jBx0FXfvRX-PaTN1nnEaLVKBfVD2-vmjJhCP1zRfpubVXPgzjIwz02LKg7_aulhtONGBCgEYGXY4FcnE6Z65whvXZOmRSJo7DmG9UAlbZUjGw0hIvmDuxCcatDGZp34xROepHmTL39HCZTfxjfJptBeozVGd_GtlYKAeKomeAQZ7s3bNKcncjaAJJi_2pi1kHMCQxaS00eL8SSB0pFqMMTJPaSGFpcvt2e96O_K9TNwNE49IFUtZhvETFPThOTRU4iGcxbr0tnfmvlb_g6dxqOtS-WXuLG_w46INI-uxU3zSFKPTc4krSnfN5MwxPf7lEyPrv08VK1Bmzp0iDAk5ycFMx7cg3GTcu-9DUCWG_ynmGHeY6TZUfUNCYc29J55Q0LhG7oPEmoyBX9AyqpJmijZvoQOhjztW6k2a-Yn_DJX2ZRXZOFhEpiuXGWFWrvGTeiU7T4Mgf7RL4ChISC7ECluEGCQx_eKh4sHLWvUdZHn6iKgO-Jqfo1bMpbDq89g4xLlES-FwtTnGuRjoxqu-ILXJQ5i24g5tIMfIq7XaPJhUBWGnQTboz_03g6xSU4xESktAAzfEJK6aO2q2sq-Kw6mCyAn3YSPSOn2cJSEbhhn8Wvbwwexh9G43awvlsXbLUeJeAZat58k6B9ocIjUdMIJf24q_TVMRYPRNG6WsVmWbTVgaYgz3Ikq4uFPayHtkGZ6gfKfhSSmbD07okIO4vpcdG_CzkkLCJJ2FdfWU-gx-lwTClgtoU3L2_87kdTyverdWCPvgvrZGjuajzPKsnOKyyqvO9xUIg13atYOnAb-8tr2r18AhKqo030jAdFuP1VQPt1DbB2Fqsvb1jiI0E_DRUdmoMC-1wV49q5bW5pg8NWPAGwWi3ITeshofNez46VUSVSb1Anoxm0sZSeMRVUppuHtSYomIIGl8qhm1zmJBQ1WiTiUf2bcVgHj6sf6M_g3hu47b5HP9nYZWMaLeVQIpiIjvDlswZWyzH9ZswYKhrk-AjjHmw5GYTUfuf3vW_xuaHpMPdu4QoR8ss5H88GW1QTEf9HSeBnjCVDxvJjnla3fd2qSrZfrIe3amslW5-NBMsn_PRBeEpq0QM6IzQxr3t24BZm2O8HbgEuNNA1AO1qCmd3XdVimVfS_bG7Xwpv4s_BwbAPR8okxSnMm2Q_vTba7Ui9mcLQCfTpaTNHmcNNdAsfV1Y2kxhsQwKlv2XVcklsAncVsvKQiG40hlGv7KkOKS9RFrR_zdFV0cxHhJJfn71tCBHz5IfFiZQCKT4iojJsK45Dm0H0R8rCBcdb1XxH_uW6T7TaY-zjo49vyd66vlycMRUTD_KP8gp_7pRoTVQi0FrBzjmkjxqlug&sai=AMfl-YSSwyGx2GMUxeLbFQHe_29GCr6igsVkcVDUniOZaRebXo-D5EeaOY-ftzWMQz8jLc7M86eb06roJvxfRl0bZQAnYQ1rYSDJRfudCjVK2TU4enyB_F8hcgStYif_3nZfiaJPNUTY4iJKGjWnvqg_jqWfov-TqAkz5oVE9rvzhkOfePPQZCEBX7ZnHb5EucjrnAkjyDDnwHQRgC_RLJM3zqZXdNOPpG5jeHvfznyhoTeaSYQI0XneNzB2WgF92gBHs4hIO8QdaFqb2mIsISjCkanbUl38W33QT-GJPumFpgCqy2LTGI06zKzW4XdQyfSgQVQX06Q9J1R3ePKLlrUsyB5kkycB_QuBaSxTM1G1UNCVnajSCcfYHCWp8cxCWDNh0ihPP-bVhxKPuiS7tfLfqmlCVKnSnfShr2Q_&sig=Cg0ArKJSzHSViWNjG2puEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1472&cbvp=1&cisv=r20250521.91916&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:46:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x7e8a137667e74580000000000000000","908705425":"0x174073ce661a71940000000000000000","908705426":"0xa4ea5d79de0c58e80000000000000000"},"debug_key":"6152752130386901195","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"7540511154148124721"}
server: cafe

GET
H3 200 2927632976248728908
s0.2mdn.net/simgad/ Frame B9A4 18 KB
18 KB 702ms
134ms Image
image/jpeg 172.253.122.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2927632976248728908

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f148.1e100.net

Software

sffe /

Resource Hash

9f91935eff88d893b4f31330ad20a804367e78713b807bf654464d22a70ec027

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

age: 44371
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sun, 24 May 2026 06:26:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 24 May 2025 06:26:36 GMT
last-modified: Tue, 29 Apr 2025 13:28:02 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 18213
x-xss-protection: 0
server: sffe

GET
H2 200 adnm.sonar.js
macro.adnami.io/macro/gen/ Frame B9A4 16 KB
16 KB 421ms
135ms Image
application/x-javascript 2600:1408:5400:17::17dd:e3b3
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to Show image

Full URL: https://macro.adnami.io/macro/gen/adnm.sonar.js?gid=bcgehc2qxqzi4g&tid=PlacementID:421641522,CreativeID:234229028&source=&gdpr=0&gdpr-consent=&info=Campaign-Manager-360
Requested by: Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1408:5400:17::17dd:e3b3 Ashburn, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

content-md5: Cf9rMcRFUj4YhaA96XxLqA==
cache-control: max-age=5111
content-encoding: br
x-ms-version: 2009-09-19
etag: 0x8DD99EAC3E0D7E3
x-ms-lease-status: unlocked
x-ms-request-id: b5bdefca-f01e-004f-14d3-cba43d000000
access-control-allow-origin: *
content-length: 8116
date: Sat, 24 May 2025 18:46:07 GMT
content-type: application/x-javascript
last-modified: Fri, 23 May 2025 11:12:54 GMT
x-ms-blob-type: BlockBlob

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame 6D50 0
48 B 148ms
130ms Script
text/plain 207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:07 GMT
server: nginx

GET
H3 200 setuid
prebid.intergient.com/ Frame 188E 0
1 KB 160ms
156ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=03429431-d51c-c346-9591-6e62b517f67d
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112367&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=KTihZIzMi5MWhbHCTBMgfLARorpsYgXGHHBHVqkCIOI%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 24 May 2025 18:46:07 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112367&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=KTihZIzMi5MWhbHCTBMgfLARorpsYgXGHHBHVqkCIOI%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 944ef43888c87bce-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=9164073885411081074&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZH-HQr8SyQRV6BWjvG&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

281ms
130ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:11 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 188E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=55201e87267623c2&is_secure=true&networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADdJDXgN-5VgJ_PhuQAQEBAQEBAQCWApztBQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-43...

42 B
450 B

125ms
124ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADdJDXgN-5VgJ_PhuQAQEBAQEBAQCWApztBQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=-1
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADdJDXgN-5VgJ_PhuQAQEBAQEBAQCWApztBQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=-1
content-length: 0
date: Sat, 24 May 2025 18:46:10 GMT
pragma: no-cache
server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

274ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:11 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZHbP-svwPKQU6hfpj2&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

297ms
132ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=4176077111496352796998&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZHBMcpnRtfTxq_ECgf&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

286ms
132ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZH-HQr8SyQRV6BWjvG&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

276ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:11 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 188E
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%2...
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=-1&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=ac80b5bf67f05c8&is_secure=true&networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=-1&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAAsyqgJpbcQwJyvomIAQEBAQEBAQCWApzqdQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-43...

42 B
369 B

126ms
122ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAAsyqgJpbcQwJyvomIAQEBAQEBAQCWApzqdQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=-1
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAAsyqgJpbcQwJyvomIAQEBAQEBAQCWApzqdQEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=-1
content-length: 0
date: Sat, 24 May 2025 18:46:10 GMT
pragma: no-cache
server: nginx

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=b7bd6956-748e-4a63-a050-dd45f7be03ec
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

298ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-76ca2fa0-5650-48a6-855d-6da49d4bceca
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

272ms
129ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:11 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=d4f314446edad2f5ec31372bed9204f&_fw_gdpr=&_fw_gdpr_consent=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

295ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:11 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 188E
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3911139674308147000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

303ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame A64A 7 B
1 KB 532ms
138ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2

200

setuid
elb.the-ozone-project.com/ Frame F96E
Redirect Chain

https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Felb.the-ozone-project.com%2Fsetuid%3Fbidder%3Dadform%26gdpr%3D0%26gdpr_consent%3D%26uid%3D%24UID
https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=6370754236031705151

0
360 B

400ms
399ms

Image
text/plain

172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=6370754236031705151
Requested by: Host: elb.the-ozone-project.com
URL: https://elb.the-ozone-project.com/static/load-cookie.html?gdpr=0&gdpr_consent=&usp_consent=1NNY&gpp=&gpp_sid=&pubcid.org=7e20c29d-157d-459b-88e5-dfdc3c442609&linkedin.com=e58ace1c-0f3d-4c34-91a9-61b8eed98df9&publisherId=OZONEPLA0001&siteId=3500001145&cb=1748112363263&bidder=ozone
Protocol: H2
Server: 172.64.153.66 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://elb.the-ozone-project.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
via: 1.1 google
cf-ray: 944ef43d6a3e100c-LAX
expires: 0
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/plain;charset=UTF-8
vary: Origin, Accept-Encoding
server: cloudflare

Redirect headers

access-control-max-age: 86400
location: https://elb.the-ozone-project.com/setuid?bidder=adform&gdpr=0&gdpr_consent=&uid=6370754236031705151
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B3F2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

280ms
279ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 7E10 958 B
1 KB 101ms
91ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 5ce83f0f3f4d2fbb8000e7d75a3b6a95db2ef0ac050cc50fda26c1d9de658f23

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 958
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

GET
H3 200 cm Show response
us-u.openx.net/w/1.0/ Frame 2F85 960 B
980 B 90ms
88ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 5b5ded794db0929d7004eb43a998abd5ca1c42c6c0557ddeb571014c0d2ff514

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 960
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B6C2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

279ms
278ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 24 May 2025 18:46:07 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 2F85
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openxut&userId=f4471223-5919-436f-a54f-ec6db72bd329&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZH-HQr8SyQRV6BWjvG&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

132ms
131ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F85
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074

43 B
61 B

215ms
214ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 172e9f63-55eb-4bd9-b4f8-5ee057453d49
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 2F85
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=eaec0a62-94f1-496c-90b3-7359791c92a3
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

114ms
113ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 2F85 95 B
761 B 528ms
92ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=b95406f8-02b1-428b-852b-6b7c730b3277

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F85
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=

43 B
61 B

91ms
91ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2F85
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7

43 B
61 B

106ms
106ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 208fba45-8d37-47c4-a96e-7a1016b6fda4
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7
Content-Length: 112
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

dds
rtb.openx.net/sync/ Frame 2F85
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=YHz_OPAwxiIpvr8dk57JwQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

93ms
93ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 7E10
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=4da50461-d6ed-44ba-b0c0-b1aef1204710&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kt0mALZHBMcpnRtfTxq_ECgf&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

186ms
132ms

Image
image/avif

206.189.181.131
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 206.189.181.131 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:10 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7E10
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074

43 B
61 B

184ms
109ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=9164073885411081074
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8b292d27-2673-44af-a55d-5f32803672d6
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 7E10
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=eaec0a62-94f1-496c-90b3-7359791c92a3
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

114ms
114ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 7E10 95 B
417 B 608ms
92ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=b95406f8-02b1-428b-852b-6b7c730b3277

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7E10
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=

43 B
61 B

234ms
219ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 7E10
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7

43 B
61 B

108ms
107ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:07 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: f3b9e701-48eb-463c-bea6-a9147e4e9610
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=6c01647d-c195-4e6c-bee4-3f27b7dc26e7
Content-Length: 112
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

dds
rtb.openx.net/sync/ Frame 7E10
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=YHz_OPAwxiIpvr8dk57JwQ==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
60 B

91ms
90ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame B9A4 2 KB
1 KB 370ms
160ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=1&ttmms=23&ttfrms=58&brid=96&bridua=3&bds=1&tstype=128&prndr=1&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTau74_d5g_g6hd_26bh2gg_abb7c_7fgged%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=87&ddur=1331&uid=1748112367270353&jsCallback=dvCallback_1748112367270497&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7821&tgjsver=7821&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2Ffc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html&fcifrms=23&brh=2&dvp_epl=201&noc=16&nav_pltfrm=Linux%20x86_64&ctx=12268837&cmp=32905093&sid=8602117&plc=421641522&crt=234229028&adsrv=1&advid=5925338&unit=160x600&c1=2765340&bsimpid=b0cc397d1e824def90f911952285345c&prr=1&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0jhO7WWL6Ln7CLFODxkTa2T&aucmp=22561170956&aucrtv=658174412&auorder=1021271876&ausite=1995081996404&auxch=1&pltfrm=1&aufilter1=2765340&autt=1&mib=0&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=125166525893.44614&ee_dp_sukv=125166525893.44614&dvp_tukv=26333125.657089885&ee_dp_tukv=26333125.657089885&dvp_strhd=0.5&dvpx_strhd=0.5&dvp_tuid=584598831671&jurtd=3355951009
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 743f94c94fe8d9e8cb28a70cb1e0a588f6275d6027292496071efe02cc8a6c2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 05/23/2025 18:46:07
Date: Sat, 24 May 2025 18:46:07 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0FE4 0
20 B 158ms
157ms Image
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BnAq-7BMyaKOXOK-QpccPo-2h-Q4AAAAAOAHgBAI&bg=!j4yljMPNAAYA59AtIOc7ADQBe5WfOKBtrs2RN561NXZoPgxsmGRLDb-9u-xdDE9aPV9-XDBa9Lvh-VMICP_t27tOGXheAgAAAXRSAAAABmgBB34ANUXZ1aVFHaPuoW3pHgp16dx526SfPH6qPsniqzT7HOWtxH4NKXAEnnTqTftMC-pBirC4p6ACmQKoSRsKqRvhLrdXmhizTlCIgZ-_g5RjFjHpTXf2RIJMDtcKMXGclpJB7ACbcColhKH98keJt0y3XML7nePdXu4-hN8bTFLdOgjC4xftllfQgh3n0cO6xDbaNsgAmpY2ynesMJNTTgNfmbsQzfXUxlkwxEZgUW1hndEiu12tNKrlxNA_8fD-KC13vIi-fXfnWjxUeVfR_619El7uyYF6w_7cb1z3TyAnTcPCjWFdEYh0if6KyPNLROz-SxrjG-UvygDV7VIecRsE6iVhQXPC4Oarh3HB_D5GjDKaGQLhpSgwJxpr09FkP7iouUlKnlo6DrI8F5OEtj6IZq2azQqIfG-dthwudHt_IWHRIpbkJnSmVemnZ1-gZnxBhb04Rh32-6eS2BCC-WWJUMPfUf5RAc7tEwv70w3hma4baEPvv5X_E9tz6g6b3GMKFuJkvwznRG8X9jbYCKxJy4qRtdlEUYiQc27Ht11bP4NL0x-JxQB82tI5t5w2FEbo3945DPjw6xxUCHMVTy5eXb4FkgcgCqWsRhuljqKkym1dcy7nAzvcZEp72zstP11kZwKaYKN-hn-WXhO2JsRXmUbbrdh5onBIookgeQ4mW66J9Mnl-l2pkYo1P0i0ObOXKJouXBOC0r-2uozlKL7cYOaWaHSdmJZHNe1eipUQyEVTCt53CXvQmNd4XTrK_LewsPRDUjVFQskJJj83UNuMxIWqFfvLoT1KoVsv70JQpFO28Yaku0vaBBA6PUqzmORfrtBPxr0sh6Ph0drm4oaWGSjNUxuokCwjS2zykjyX5qe9EfT_3N9g9F5aCXRM1Y_JWWUB8w38WNmDTIuoEq8pDyDTvn-QkUW_OmON7uRS1dsHPjMXi8pCKpst-7Rso5DlPcZs9pf642LdBbwMaEUx_V8

Requested by

Host: fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com
URL: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 6D50 2 KB
2 KB 128ms
128ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=4043370&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 066bd5f0986334ea725fa1422c47a0a8f754646f5c75b61938d25557dbe1b829

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-length: 1891
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/html; charset=UTF-8

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame A64A 170 B
188 B 139ms
138ms Image
image/png 172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

usersync
vid-io-iad.springserve.com/ Frame A64A
Redirect Chain

https://pixel.rubiconproject.com/token?pid=52948&gdpr=1&gdpr_consent=&us_privacy=&rk=iad&us_privacy=1NNY
https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB2KYRTO-8-AE7Z&gdpr=1

43 B
206 B

382ms
124ms

Image
image/gif

3.222.72.15
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB2KYRTO-8-AE7Z&gdpr=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.222.72.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-222-72-15.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-origin: *
content-length: 43
date: Sat, 24 May 2025 18:46:09 GMT
content-type: image/gif
server: nginx
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB2KYRTO-8-AE7Z&gdpr=1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A64A
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

954ms
122ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: b08c627b67f10e75995ce6908d3f9f7b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=abf4665b-e314-4656-8b61-b74aeac478c3&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Sat, 24 May 2025 18:46:08 GMT
server: Kestrel

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame A64A 43 B
855 B 1518ms
457ms Image
image/gif 67.220.228.202
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

67.220.228.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PVMB7E8KF0B23HRPJ4P8
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 24 May 2025 18:46:09 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame A64A 43 B
855 B 144ms
139ms Image
image/gif 98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 00K6BHY9JGS6FZAV62WQ
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Sat, 24 May 2025 18:46:08 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A64A
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/fnOczzrDA0cirC1vDmQz3w?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bu2zP.lE2oIbrlIe2KfxJHLz8CCu.D1cPVZSqQ--~A

42 B
1 KB

903ms
151ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bu2zP.lE2oIbrlIe2KfxJHLz8CCu.D1cPVZSqQ--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 5e07703167439847c6c49a939083c0fd
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-bu2zP.lE2oIbrlIe2KfxJHLz8CCu.D1cPVZSqQ--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame A64A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=MB2KYRTO-8-AE7Z&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

134ms
134ms

Image
image/gif

98.82.156.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MB2KYRTO-8-AE7Z&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.156.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 2BZ5NTCX2SWTB04Q64KT
Content-Length: 43
Date: Sat, 24 May 2025 18:46:08 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MB2KYRTO-8-AE7Z&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A64A
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmZjM2ExZWNmYzliMzI0M2Y5OTBmMmM3M2NmZDNmMGU2NDU3MjY4OA&us_privacy=1NNY

170 B
188 B

147ms
147ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmZjM2ExZWNmYzliMzI0M2Y5OTBmMmM3M2NmZDNmMGU2NDU3MjY4OA&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZmZjM2ExZWNmYzliMzI0M2Y5OTBmMmM3M2NmZDNmMGU2NDU3MjY4OA&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 82a6cabd8b3f0d2d2ae6e86e2699f0ba
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A64A
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIyS1lSVE8tOC1BRTda&us_privacy=1NNY

170 B
188 B

137ms
137ms

Image
image/png

172.253.62.157
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIyS1lSVE8tOC1BRTda&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-211-170-34.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUIyS1lSVE8tOC1BRTda&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame A64A
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB2KYRTO-8-AE7Z&us_privacy=1NNY

0
143 B

153ms
152ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB2KYRTO-8-AE7Z&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 37804E775E4A42C098B866C86296B0C7 Ref B: LAX311000114049 Ref C: 2025-05-24T18:46:08Z
x-li-fabric: prod-lva1
x-li-uuid: AAY15iDDf/wIKs/pFGmSQg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Sat, 24 May 2025 18:46:07 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB2KYRTO-8-AE7Z&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A64A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACQdk7QZCgAABwxQRwtfA&expires=30

42 B
1 KB

217ms
129ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACQdk7QZCgAABwxQRwtfA&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: cdd55fb02049ca8b9389527f6c1a1194
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACQdk7QZCgAABwxQRwtfA&expires=30
Content-Length: 0
Date: Sat, 24 May 2025 18:46:09 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

200

v1
match.sharethrough.com/sync/ Frame A64A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1NNY
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY

68 B
323 B

127ms
127ms

Image
image/png

54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9e7742894a018a40b59a2ed2117c85b5
content-length: 0
Content-Type: text/html

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame A64A
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1&us_privacy=1NNY
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY

95 B
124 B

93ms
93ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

ec2-3-223-198-246.compute-1.amazonaws.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=MB2KYRTO-8-AE7Z&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
capi.connatix.com/us/ Frame A64A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1NNY
https://capi.connatix.com/us/pixel?puid=MB2KYRTO-8-AE7Z&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY

0
329 B

414ms
74ms

Image
text/plain

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MB2KYRTO-8-AE7Z&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 944ef448edffcb7e-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Sat, 24 May 2025 18:46:10 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MB2KYRTO-8-AE7Z&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
content-length: 0
Content-Type: text/html

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame A64A
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1NNY
https://sync.a-mo.net/setuid/magnite?uid=MB2KYRTO-8-AE7Z&us_privacy=1NNY

0
725 B

413ms
122ms

Image
text/plain

125.253.89.187
SS-ASH

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MB2KYRTO-8-AE7Z&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 125.253.89.187 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Sat, 24 May 2025 18:46:10 GMT
x-envoy-upstream-service-time: 4
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MB2KYRTO-8-AE7Z&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 83041abbe8494cb29eff3083edd6dff6
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame A64A
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&expires=30&us_privacy=1NNY

42 B
1 KB

610ms
137ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d3682eda7e5cb79782b1d5475f50e8fc
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: c226b52b-7322-4423-85ab-140bb09dcb1d
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=6c01647d-c195-4e6c-bee4-3f27b7dc26e7&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Sat, 24 May 2025 18:46:08 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 PAND1_EN_DISPLAY160X600_COLLECTION_MOMENTS_X_MIXED_CONSIDERATION-V1-638815300757419643-171e30ec-40c1-42be-93b2-86f2cc2da680.html Show response
s0.2mdn.net/sadbundle/13638052880094068736/ Frame B146 6 KB
2 KB 130ms
126ms Document
text/html 172.253.122.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13638052880094068736/PAND1_EN_DISPLAY160X600_COLLECTION_MOMENTS_X_MIXED_CONSIDERATION-V1-638815300757419643-171e30ec-40c1-42be-93b2-86f2cc2da680.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f148.1e100.net

Software

sffe /

Resource Hash

f4f4b7d278341250efd859ebd74d7b6d0b2d7e200fcf27a039af65fc15697db8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 192438
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1893
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 22 May 2025 13:18:50 GMT
expires: Fri, 22 May 2026 13:18:50 GMT
last-modified: Tue, 29 Apr 2025 13:28:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H/1.1

204
No Content

event.png
tpsc-ue1.doubleverify.com/ Frame B9A4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_hm=**&google_redir=https%3A%2F%2Ftpsc-ue1.doubleverify.com%2Fevent.png%3Fimpid%3Daf5a4e6534984cc183424e6412d...
https://tpsc-ue1.doubleverify.com/event.png?impid=af5a4e6534984cc183424e6412d83996&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0

0
162 B

512ms
122ms

Ping
text/plain

34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=af5a4e6534984cc183424e6412d83996&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

Expires: 2025-05-23T18:46:08
Cache-Control: max-age=0
Date: Sat, 24 May 2025 18:46:08 GMT
Pragma: no-cache
Connection: keep-alive

Redirect headers

cache-control: no-cache, must-revalidate
location: https://tpsc-ue1.doubleverify.com/event.png?impid=af5a4e6534984cc183424e6412d83996&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 390
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame B9A4 0
0 137ms
137ms Fetch
image/png 142.251.163.148
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst1IOf5cQq_giwsmarPehxM3ix0jJzCfg2RRkh0-2ms4_vaGLvnXphsoJ8wI6KNjb2Hk7VU5NC6X6yUbubcWTlDpZKLFLN4rOtI_AVkqaCo69D3saU1aSpMxpVrv2Z67xzNP_uY-FaedYw3VLE39ppfVoNJa17HlQ6rnW-fEVtvymrmSrcnbzs1u7hnARlKjkoVQ5YfdrqgpXX54SUvGC32E0xK8V05srky1CLLpuEGeabhluKEfMVh4_oiTgFTlVjYn76i26KSVrMjMGHB2TYzLjg12gPfTCeQ0o6uzYA8OvxOJwQPTtQT-KE2cVczi4r3RxRRvySN0JmA0oHR_OSiS2wQqMTQeEYuJfxb0xsdfoZVQIJjtTi6nHLbsz67QP-VTTVGAmFmtVUGktKng7g48XMklCOlZhl59_DiGkkDMudmGolWDQvPLE16Qgez5BvZygk2R6YRWK037Ee_m4ms8tGGkLeD770jBx0FXfvRX-PaTN1nnEaLVKBfVD2-vmjJhCP1zRfpubVXPgzjIwz02LKg7_aulhtONGBCgEYGXY4FcnE6Z65whvXZOmRSJo7DmG9UAlbZUjGw0hIvmDuxCcatDGZp34xROepHmTL39HCZTfxjfJptBeozVGd_GtlYKAeKomeAQZ7s3bNKcncjaAJJi_2pi1kHMCQxaS00eL8SSB0pFqMMTJPaSGFpcvt2e96O_K9TNwNE49IFUtZhvETFPThOTRU4iGcxbr0tnfmvlb_g6dxqOtS-WXuLG_w46INI-uxU3zSFKPTc4krSnfN5MwxPf7lEyPrv08VK1Bmzp0iDAk5ycFMx7cg3GTcu-9DUCWG_ynmGHeY6TZUfUNCYc29J55Q0LhG7oPEmoyBX9AyqpJmijZvoQOhjztW6k2a-Yn_DJX2ZRXZOFhEpiuXGWFWrvGTeiU7T4Mgf7RL4ChISC7ECluEGCQx_eKh4sHLWvUdZHn6iKgO-Jqfo1bMpbDq89g4xLlES-FwtTnGuRjoxqu-ILXJQ5i24g5tIMfIq7XaPJhUBWGnQTboz_03g6xSU4xESktAAzfEJK6aO2q2sq-Kw6mCyAn3YSPSOn2cJSEbhhn8Wvbwwexh9G43awvlsXbLUeJeAZat58k6B9ocIjUdMIJf24q_TVMRYPRNG6WsVmWbTVgaYgz3Ikq4uFPayHtkGZ6gfKfhSSmbD07okIO4vpcdG_CzkkLCJJ2FdfWU-gx-lwTClgtoU3L2_87kdTyverdWCPvgvrZGjuajzPKsnOKyyqvO9xUIg13atYOnAb-8tr2r18AhKqo030jAdFuP1VQPt1DbB2Fqsvb1jiI0E_DRUdmoMC-1wV49q5bW5pg8NWPAGwWi3ITeshofNez46VUSVSb1Anoxm0sZSeMRVUppuHtSYomIIGl8qhm1zmJBQ1WiTiUf2bcVgHj6sf6M_g3hu47b5HP9nYZWMaLeVQIpiIjvDlswZWyzH9ZswYKhrk-AjjHmw5GYTUfuf3vW_xuaHpMPdu4QoR8ss5H88GW1QTEf9HSeBnjCVDxvJjnla3fd2qSrZfrIe3amslW5-NBMsn_PRBeEpq0QM6IzQxr3t24BZm2O8HbgEuNNA1AO1qCmd3XdVimVfS_bG7Xwpv4s_BwbAPR8okxSnMm2Q_vTba7Ui9mcLQCfTpaTNHmcNNdAsfV1Y2kxhsQwKlv2XVcklsAncVsvKQiG40hlGv7KkOKS9RFrR_zdFV0cxHhJJfn71tCBHz5IfFiZQCKT4iojJsK45Dm0H0R8rCBcdb1XxH_uW6T7TaY-zjo49vyd66vlycMRUTD_KP8gp_7pRoTVQi0FrBzjmkjxqlug&sai=AMfl-YSSwyGx2GMUxeLbFQHe_29GCr6igsVkcVDUniOZaRebXo-D5EeaOY-ftzWMQz8jLc7M86eb06roJvxfRl0bZQAnYQ1rYSDJRfudCjVK2TU4enyB_F8hcgStYif_3nZfiaJPNUTY4iJKGjWnvqg_jqWfov-TqAkz5oVE9rvzhkOfePPQZCEBX7ZnHb5EucjrnAkjyDDnwHQRgC_RLJM3zqZXdNOPpG5jeHvfznyhoTeaSYQI0XneNzB2WgF92gBHs4hIO8QdaFqb2mIsISjCkanbUl38W33QT-GJPumFpgCqy2LTGI06zKzW4XdQyfSgQVQX06Q9J1R3ePKLlrUsyB5kkycB_QuBaSxTM1G1UNCVnajSCcfYHCWp8cxCWDNh0ihPP-bVhxKPuiS7tfLfqmlCVKnSnfShr2Q_&sig=Cg0ArKJSzHSViWNjG2puEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2243&vt=11&dtpt=771&dett=4&cstd=2239&cisv=r20250521.91916&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.148 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f148.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://fc05d808e950ae39a880233f40f78865.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Sat, 24 May 2025 18:46:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x7e8a137667e74580000000000000000","908705425":"0x174073ce661a71940000000000000000","908705426":"0xa4ea5d79de0c58e80000000000000000"},"debug_key":"8783682066024982446","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"8326410359395995040"}
server: cafe

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B6C2 44 KB
0 475ms
468ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 5e30418c1494afb63c9670a618886b6fb00e398b504cbdcd5a2cea9f14571f4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=60677
content-encoding: gzip
expires: Sun, 25 May 2025 11:37:23 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Sat, 24 May 2025 18:46:06 GMT
last-modified: Sat, 24 May 2025 11:37:23 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame 53FD
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFKQXdVN1FaQ2dBQUJzM1o3QlQyZw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAJAwU7QZCgAABs3Z7BT2g&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=5918392169278580452&gdpr=0&gdpr_consent=

43 B
433 B

125ms
125ms

Document
image/gif

3.223.198.246
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=5918392169278580452&gdpr=0&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.223.198.246 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Sat, 24 May 2025 18:46:10 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Sat, 24 May 2025 18:46:09 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=5918392169278580452&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 724B 0
340 B 666ms
124ms Document
image/gif 169.197.150.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Sat, 24 May 2025 18:46:08 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: c

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F53F
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=

42 B
382 B

156ms
156ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Sat, 24 May 2025 18:46:08 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Sat, 24 May 2025 18:46:08 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 8984
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321857711891399
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4

0
351 B

516ms
128ms

Document
application/javascript

52.73.180.144
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.180.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-180-144.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://ads.pubmatic.com/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Sat, 24 May 2025 18:46:10 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

cache-control: private,max-age=86400
content-length: 115
content-type: text/html; charset=utf-8
date: Sat, 24 May 2025 18:46:10 GMT
location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 018C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
172 B

219ms
218ms

Document
image/png

151.101.194.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDIT8AAKxhB2-gA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2373
cache-control: no-cache
content-length: 85
content-type: image/png
date: Sat, 24 May 2025 18:46:09 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 9376
x-robots-tag: noindex
x-served-by: cache-mad2200121-MAD
x-timer: S1748112369.025104,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDIT8AAKxhB2-gA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-mad2200121-MAD
x-timer: S1748112368.294638,VS0,VE92

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 938D 0
0

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 176D 0
1 KB 164ms
162ms Document
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 944ef43d5c4e7bce-LAX
content-encoding: br
content-type: text/html
date: Sat, 24 May 2025 18:46:08 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748112368&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JiANdA7dfMVQrePT1pAlEq5YF22JvhDALuYvn3t5cHw%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748112368&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JiANdA7dfMVQrePT1pAlEq5YF22JvhDALuYvn3t5cHw%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 6D50 43 B
653 B 492ms
147ms Image
image/gif 3.161.213.57
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-57.yul62.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 fbdc01f132101cb05310363b09502a86.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif
x-amz-cf-pop: YUL62-P1
server: AAWebServer
x-amz-cf-id: XOfbAbj9WZxQr2xKyBzlTdMOIr-lpTKbkBgQE-itSCIiuOmTM4v78Q==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 qmap
sync.crwdcntrl.net/ Frame 6D50 49 B
222 B 434ms
141ms Image
image/gif 184.73.75.189
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.73.75.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-75-189.compute-1.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache
pragma: no-cache
expires: 0
access-control-allow-origin: *
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 49
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame 6D50
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&ttd_puid=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C

95 B
124 B

101ms
101ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&ttd_puid=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/png
server: Jetty(11.0.25)

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=abf4665b-e314-4656-8b61-b74aeac478c3&ttd_puid=78c5ef2e-2ca0-45a6-b99e-5a791eb928c2%2C%2C
content-length: 359
date: Sat, 24 May 2025 18:46:08 GMT
server: Kestrel

GET
H/1.1

200
OK

35759
i6.liadm.com/s/ Frame 6D50
Redirect Chain

https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4
https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0
https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=abf4665b-e314-4656-8b61-b74aeac478c3
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=abf4665b-e314-4656-8b61-b74aeac478c3

43 B
576 B

842ms
139ms

Image
image/gif

2600:1f18:ed:550f:79be:79d2:f5d7:8df9
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=abf4665b-e314-4656-8b61-b74aeac478c3

Requested by

Protocol

HTTP/1.1

Server

2600:1f18:ed:550f:79be:79d2:f5d7:8df9 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: 60a809d2cb81ca55
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Sat, 24 May 2025 18:46:09 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=abf4665b-e314-4656-8b61-b74aeac478c3
Content-Length: 0
Date: Sat, 24 May 2025 18:46:08 GMT
trace-id: 076da1e631096026
Request-Time: 0
Connection: keep-alive

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=443e6dfc1f7423c2&is_secure=true&networkId=17100&version=1&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA-0teL5iLXAIUZOS3AQEBAQEBAQCWApzqdAEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-43...

42 B
393 B

128ms
126ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA-0teL5iLXAIUZOS3AQEBAQEBAQCWApzqdAEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:10 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAA-0teL5iLXAIUZOS3AQEBAQEBAQCWApzqdAEBAQEBAQEB&expiration=1748198770&nuid=7808CB4C-DCEC-4360-8CC4-B5D9DF6EB3B4&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Sat, 24 May 2025 18:46:10 GMT
pragma: no-cache
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 6D50 0
164 B 640ms
124ms Image
text/plain 34.201.175.203
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.201.175.203 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-201-175-203.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Sat, 24 May 2025 18:46:08 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=

42 B
388 B

135ms
133ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=fc70617f-6ac7-472d-8a5a-4ab0599ed4a3-683213ef-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
server: A

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 6D50
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=

1 B
242 B

132ms
131ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2929127410558735037&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Sat, 24 May 2025 18:46:07 GMT

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 2DED
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY

269 B
379 B

504ms
502ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Sat, 24 May 2025 18:46:08 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Sat, 24 May 2025 18:46:08 GMT
location: https://eus.rubiconproject.com/usync.html?p=pbs-Playwire&gdpr=&gdpr_consent=&us_privacy=1NNY
server: AkamaiGHost

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B3F2 44 KB
0 475ms
468ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 5e30418c1494afb63c9670a618886b6fb00e398b504cbdcd5a2cea9f14571f4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=60677
content-encoding: gzip
expires: Sun, 25 May 2025 11:37:23 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Sat, 24 May 2025 18:46:06 GMT
last-modified: Sat, 24 May 2025 11:37:23 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 137ms
136ms Fetch
text/plain 2607:f8b0:4004:c07::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55l1v9101576445za200&_p=1748112359972&gcs=G1--&gcd=13l3l3l3l5l1&npa=0&dma=0&tcfd=10000&tag_exp=101509157~103116026~103130495~103130497~103200004~103211513~103233427~103252644~103252646~104481633~104481635&cid=4840058.1748112363&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1748112363&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fswxqz.gradientking.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=37&tfd=9435
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c07::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:99:0
report-to: {"group":"ascnsrsggc:99:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:99:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:99:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 24 May 2025 18:46:08 GMT
content-type: text/plain
server: Golfe2

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 303ms
299ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250515.1/main.de88eb0a31bf4b182063.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Sat, 24 May 2025 18:46:08 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B9A4 42 B
65 B 157ms
156ms Fetch
image/gif 142.251.111.155
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssl88ucnW4Xi91s65dIEtUyNaVMwp_46UoF4dzC9VxSqfXzeah7r2b5EtRsiBye20gdW8FyYL7vkBz4hDJaL-UCoyWmYp59OmthQq26Rf1-LrO-vQXUWBaOWk27TrZbKyly_AysJLb-dt3x4krfbsqdefk9cpvQgRi_LuPPNVD-7EdLl7jOPaHLaXYJiazOiVac-K4WOJnT&sai=AMfl-YQyiSQRq6-m4yeEui1o7Gq7TGiGDvPXL0OVlMrXMGUx_mGyYEKqYju3ApW1lqcSjf5bIJNq8nesZppW9kF-2yPq3PKyyh5cPdgV0tMrqf7iCj25gLIgtdaNzwk&sig=Cg0ArKJSzIamsRWSdvyFEAE&cid=CAQSOwDZpuyzjYMQUyZH8bRtZIEAqziYz7AhbfEWZC6kKDohY_GSwC_04JCoODBxtd6G3kiWJRsMHCN6J7BRGAE&id=lidar2&mcvt=1016&p=313,139,353,180&tm=1329.2000007629395&tu=313.3000011444092&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20250521&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4404516700&rst=1748112365768&rpt=1264&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS