paint.toys Open in urlscan Pro
15.197.167.90 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 80369
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1659
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 03:16:34 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JWAE8JDQB0Z0X0T3R04M0FTZ

Redirect headers

accept-ranges: bytes
age: 106087
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1663
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 03:16:34 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JWAE8JB9FED9WNCW1VSF5DBM

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 376ms
138ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d57aeef7e1cc78f91bfd101fb71fab851a19caf8dc5d79dba52870f04bcbf7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 946a9817ecd808ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 82ms
81ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 71649
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JWAE8JGEQ0SSZEEVAX51NV2J
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:34 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 157ms
156ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 6140
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JWAE8JGEM872W5ARPMJEMZE9
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:34 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 99ms
98ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 89385
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JWAE8JGE1B56GMJFXCBGTHBP
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 83ms
82ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 43513
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JWAE8JGE0N36V02ERSBR152X
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:34 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 77ms
76ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 43514
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JWAE8JKHZ5HKF7F7CKR3YBRY
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 78ms
76ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 39977
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JWAE8JNF0FJR0DJ3F1BJWA9M
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 03:16:35 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 158ms
82ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0c1c883dd5a6aa2932d5f9a2f839401c1417de284cc0acd2f07c1bde435fccb4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 946a9817ecdb08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
125 KB 452ms
162ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4a494212e4c1acba392c92e3fdd1ab59ff4fef91848a5804a9c1d87fb4c5141b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 03:16:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 127721
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 l2kqas_4gasjf.main.js Show response
faucetfoot.com/assets/js/ 68 KB
25 KB 405ms
193ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/js/l2kqas_4gasjf.main.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

8eb0bc46cd3ce71c3b73429963ea3d298fddc409f30d544344e0638cabea71f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-pddz.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 109 KB
34 KB 429ms
158ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5058804ba39a591e47191cce4a4c2f9b334e3e8d0aaff191d48954ee7f109a33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 705 / 20236 / m202505200101 / config-hash: 17886797544696259832
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:16:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34415
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 589 KB
180 KB 101ms
101ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8110ded3886a93d34096358d663e7c487101a735b4720a076ed8ba4af6f00f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"369edfdc43d190015e70ab72de8421b6"
age: 3989
cf-ray: 946a9818de7d08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 18:09:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 411 B
363 B 86ms
86ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4432306bea5bc5e3eb215684c33d5d61af819593a1d5c7b309e4828fa3d5f60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a16c35147bcd6c17a711b7e5cecd32a1"
age: 4005
cf-ray: 946a9818de8208ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
414 B 172ms
82ms Script
application/javascript 104.18.25.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.25.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 616c39af21bb3cbcb1310d171dd0dc1c7e66c472af9670d6511c4155fcceff95

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 946a98196e910fe9-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Wed, 28 May 2025 03:16:35 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.d2b17692f73365eb3b1b.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
2 KB 209ms
208ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db6470e8c88ce44b00b55b0299fc7908a2a65d97c97821ec15cf52d53e9d3bc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"98de13c923d1e4bdb88ad3c624400fa1"
age: 4005
cf-ray: 946a98196f6908ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:24 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.9a246b8b1f07b7fdf439.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 521 KB
158 KB 217ms
216ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 439802ea4c65ce3139bb013e0f569258a15fb5a45e65e3e558fd45bdfdce0a2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"44906344077043e1967ca3ce3b56dcab"
age: 4005
cf-ray: 946a98196f6a08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 403ms
130ms Image
image/gif 2600:9000:247b:c200:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?service=ad&adid=aqglya&adnum=239184
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:c200:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 84900
x-cache: Hit from cloudfront
x-amz-cf-id: kfJ-ROLC2FQwAfBNFdkFO50T-JmwciUPnw-cnUinDDMK5tN8W6sw6w==
date: Tue, 27 May 2025 03:41:36 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 29117767a034875a8b49afd641f25d82.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 559 B
444 B 81ms
80ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 4004
cf-ray: 946a981cbc5608ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame 7170 503 B
427 B 294ms
87ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1296dcaec9839fa03c7635bdff3028ae2659a5ce02c2a69e1b1f26271873387c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 4006
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 946a981e0daf2ef3-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 03:16:36 GMT
hw-country-code: US
last-modified: Tue, 27 May 2025 15:56:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame 04D4 503 B
0 291ms
291ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1296dcaec9839fa03c7635bdff3028ae2659a5ce02c2a69e1b1f26271873387c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 4006
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 946a981e0daf2ef3-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 03:16:36 GMT
hw-country-code: US
last-modified: Tue, 27 May 2025 15:56:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/23/desktop/Chrome/ 580 B
915 B 418ms
127ms XHR
application/json 2600:9000:24f1:a000:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Tue/23/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:a000:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f141ac0ea4e4cf8e17e13eafcd09aba18891de6dd2f8fe759ce0d34b8bd4f8df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 921
via: 1.1 a5f1848a5a38100d334f5844f0df9eac.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 580
x-amz-cf-id: -iy7_G08HRgx0yLAUgxv77ckWoDUcW4Y7npxGZuA_1CePBn4UVBqmg==
date: Wed, 28 May 2025 03:01:15 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 147 KB
39 KB 225ms
77ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ede294970ef91011fa116caddc304b79b12da961364a7efc1d36be2ef0b2ed19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "79676e47c9590aa6aaaba9fc5252337f"
via: 1.1 google
cf-ray: 946a981dc9cb262b-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39465
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/javascript
last-modified: Wed, 28 May 2025 02:41:19 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
2 KB 81ms
80ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 4005
cf-ray: 946a981cdc7a08ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:35 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:17 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 437ms
149ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 1408
via: 1.1 38ecebcaa39c8742da2b6336935bb446.cloudfront.net (CloudFront), 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: dNM5JkTNF09nzVpul0PKMD9uYj1saelslLsKtQw-PupqcBJtPmI52Q==
date: Wed, 28 May 2025 02:53:09 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
581 B 690ms
221ms Image
image/gif 2606:50c0:8001::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 22c42f3c06e688e71c0af0f10c33884e39fa82e3
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: B5AA:155858:176DB6E:198DB48:6835F75E
expires: Wed, 28 May 2025 03:21:36 GMT
x-cache: HIT
date: Wed, 28 May 2025 03:16:36 GMT
content-type: image/gif
x-served-by: cache-mad22063-MAD
x-cache-hits: 1
source-age: 90
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1748402197.523275,VS0,VE1
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 133ms
133ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 68669
x-content-type-options: nosniff
expires: Wed, 27 May 2026 08:12:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 27 May 2025 08:12:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
111 KB 171ms
170ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55q0v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

75d6823a3d0242e449662edf489b1d67e2c45df480a846435f12a100d766fd95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 03:16:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 113605
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 426ms
151ms Fetch
text/plain 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55q0v9101576445za200&_p=1748402194935&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&cid=556743572.1748402196&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748402196&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fcwqds.awadwatt.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1813
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 441ms
141ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 30990
via: 1.1 8ee187646f657ced7afa83005e9249cc.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: VJrTLZO29MB6NUMs98H5t6sY8JgG7nEfcAEKle_9S9ioronx3a0KCw==
date: Tue, 27 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/ 63 KB
23 KB 152ms
151ms Other
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9b502c40cea58eb57328f78cf48c787ab82d46606203a135bbb813ee19fb6c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8651680878418282224
age: 44114
x-content-type-options: nosniff
expires: Tue, 03 Jun 2025 15:01:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 27 May 2025 15:01:22 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23432
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505270101"

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 264ms
114ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
629 B 230ms
81ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 11684
x-goog-stored-content-encoding: identity
expires: Thu, 29 May 2025 03:16:36 GMT
x-goog-stored-content-length: 43
date: Wed, 28 May 2025 03:16:36 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwp-m9Md7hWJaK6O95iT2W_O3K0YX3EDTZBi_SAwXd0C7-wBtJkeLNNjzT2kjvLLvGjNSiR398I
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 946a981f6c6d2b90-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 282ms
132ms Image
image/x-icon 142.250.65.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 35472
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 28 May 2025 17:25:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 27 May 2025 17:25:24 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 233ms
86ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8495327431623072
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 11684
x-goog-stored-content-encoding: identity
expires: Thu, 29 May 2025 03:16:36 GMT
x-goog-stored-content-length: 43
date: Wed, 28 May 2025 03:16:36 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwp-m9Md7hWJaK6O95iT2W_O3K0YX3EDTZBi_SAwXd0C7-wBtJkeLNNjzT2kjvLLvGjNSiR398I
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 946a981f6c702b90-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

POST
H3 200 lijrtec9hv9i2rcuu74l38um Show response
faucetfoot.com/post/ 295 B
319 B 176ms
103ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/post/lijrtec9hv9i2rcuu74l38um

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/js/l2kqas_4gasjf.main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

07a757cd0a0eb0a3ed37215feb8d967437014f390a1f7d98d5fdaa3e4f52bcf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-test-jqg4.gce-us-west1, 1.1 google
expires: Wed, 28 May 2025 03:16:35 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame 7170 17 KB
7 KB 83ms
83ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4006
cf-ray: 946a981eae5d2ef3-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:19 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame 04D4 17 KB
0 75ms
75ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 4006
cf-ray: 946a981eae5d2ef3-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:19 GMT
vary: Accept-Encoding
server: cloudflare

GET e813c1f6-cd8a-48f7-9693-3426cc95a7df
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 382ms
123ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 03:16:36 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 174916
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 243ms
91ms XHR
application/json 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 82006
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Tue, 27 May 2025 04:29:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 946a9820389d102e-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
1 KB 80ms
79ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 4005
cf-ray: 946a981f4fb508ae-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 440ms
135ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 1b8597dd496fe38f2313146f373ab6e6db3ead5c589450bc46f16e7aca5411e4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 448ms
170ms Script
text/javascript 2607:f8b0:4006:81f::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81f::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec54819df0af82b3ec2255595821288f2c2eaa9c8c3c779b1d025e2728efaa05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 17583717982418206928
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:16:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145155
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 1700ms
1232ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-34-227-131-32.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
775 B 425ms
135ms Fetch
application/json 23.21.115.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.21.115.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-23-21-115-74.compute-1.amazonaws.com
Software: /
Resource Hash: 0e0e08966c5548a8256f5a9fbfabeae77b94819a6adf51686d010e39548620a4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
683 B 345ms
94ms Fetch
application/javascript 52.24.167.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.24.167.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-167-218.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: e05418216ab95ef469bd94b24192598dc4ee6b5bc6ecc2089a3d84dceaddd106

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 248ms
91ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 702109fb3db54a8c50d3266022474083c66c7b8929d9e90a3cc8b60c5d03cefa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 217 B
630 B 397ms
133ms Fetch
text/plain 34.227.131.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.227.131.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

eb1c47f64be47959f0564a4b01ab35778a42d92f1da4b408943a3f0dd4bcaced

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: a9f564ee91584991
request-time: 4
access-control-allow-credentials: true
expires: Thu, 29 May 2025 03:16:36 GMT
access-control-allow-origin: https://paint.toys
content-length: 217
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=zULYDnw2c2U3SFpndmtvZWpmRHp6ZnFlSjE5RUo5YjhwaTVzYW9xeDlGLzNFL2JyUkpkaSttMFFVU1Z5TXA3b2lpdDRMRW9EOS9HYjBVSUEvMkU5d3c0QzY2S2g4VnRudVZ4dWZ6RnVsMjZiT0djdmFJM1IyMlk0eXBHcX...

368 B
942 B

376ms
126ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=zULYDnw2c2U3SFpndmtvZWpmRHp6ZnFlSjE5RUo5YjhwaTVzYW9xeDlGLzNFL2JyUkpkaSttMFFVU1Z5TXA3b2lpdDRMRW9EOS9HYjBVSUEvMkU5d3c0QzY2S2g4VnRudVZ4dWZ6RnVsMjZiT0djdmFJM1IyMlk0eXBHcXlOYjZYYkp4WUZMcG5OUysxYU5KQVVlYjdzaFQvWXorRTl0S0p1c05UbDdnS2dvbDg2U1AwUGxENUdUb1NOZUkyNndhdFdVeEZuWDZmcyt0d1J5YlhsV0FiWWtORmc0TW8ybHFNM0hiMXRSUE5sZ092dVJJajk2c0NkMzV6QmJTaUh6MzFMdnF5fA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

85235d9d15a8c60213a05ac7152731b432963124870a2a3bd49a840e0c7b86a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 530771
expires: 0
access-control-allow-origin: null
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=zULYDnw2c2U3SFpndmtvZWpmRHp6ZnFlSjE5RUo5YjhwaTVzYW9xeDlGLzNFL2JyUkpkaSttMFFVU1Z5TXA3b2lpdDRMRW9EOS9HYjBVSUEvMkU5d3c0QzY2S2g4VnRudVZ4dWZ6RnVsMjZiT0djdmFJM1IyMlk0eXBHcXlOYjZYYkp4WUZMcG5OUysxYU5KQVVlYjdzaFQvWXorRTl0S0p1c05UbDdnS2dvbDg2U1AwUGxENUdUb1NOZUkyNndhdFdVeEZuWDZmcyt0d1J5YlhsV0FiWWtORmc0TW8ybHFNM0hiMXRSUE5sZ092dVJJajk2c0NkMzV6QmJTaUh6MzFMdnF5fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 269275
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 03:16:36 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_5ae1028a-7b22-45a8-87c9-1dac83f6ede1_1748402196331
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfNWFlMTAyOGEtN2IyMi00NWE4LTg3YzktMWRhYzgzZjZlZGUxXzE3NDg0MDIxOTYzMzEQABoNCJSA2sEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=1d4458e3fc09b90ee3bc58c38944ef552276628a236a7922f425f6975632bc5a791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=1d4458e3fc09b90ee3bc58c38944ef552276628a236a7922f425f6975632bc5a791426b5417dce21&rand=09965096
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=1d4458e3fc09b90ee3bc58c38944ef552276628a236a7922f425f6975632bc5a791426b5417dce21&rand=09965096&expected_cookie=33f4f35e-7ac7-46bf-926c-41192eae0b23

0
361 B

108ms
108ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=1d4458e3fc09b90ee3bc58c38944ef552276628a236a7922f425f6975632bc5a791426b5417dce21&rand=09965096&expected_cookie=33f4f35e-7ac7-46bf-926c-41192eae0b23
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 86FEF8C451794E5B840BCBD9BB7CB841 Ref B: LAX311000115023 Ref C: 2025-05-28T03:16:37Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAY2KZvnyJJrtay8dVIClA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:37 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
location: /db_sync?pid=10339&puuid=1d4458e3fc09b90ee3bc58c38944ef552276628a236a7922f425f6975632bc5a791426b5417dce21&rand=09965096&expected_cookie=33f4f35e-7ac7-46bf-926c-41192eae0b23
x-msedge-ref: Ref A: CE533C4D6C534907B70EF5669EAAD76E Ref B: LAX311000115023 Ref C: 2025-05-28T03:16:37Z
x-li-fabric: prod-lor1
x-li-uuid: AAY2KZvlw4vLgUdqD4RDjg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:37 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_5ae1028a-7b22-45a8-87c9-1dac83f6ede1_1748402196331
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5ae1028a-7b22-45a8-87c9-1dac83f6ede1_1748402196331

1 KB
2 KB

139ms
139ms

Script
application/javascript

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5ae1028a-7b22-45a8-87c9-1dac83f6ede1_1748402196331
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: 3b7d656bc911c91e6fd63f61e2200f99c9071f4e94c032c903767147f80dbb4a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:37 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5ae1028a-7b22-45a8-87c9-1dac83f6ede1_1748402196331
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:36 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 148ms
148ms Fetch
text/plain 2607:f8b0:4006:81d::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55q0v9102396898za200zb9101576445&_p=1748402194935&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&cid=556743572.1748402196&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748402196&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fcwqds.awadwatt.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1748402194935&tfd=2200
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55q0v9101576445za200&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 203 KB
66 KB 483ms
184ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

982a1691bdcc6acc2909c7777d06dc5249a2dfd9fe6487e3b3f4d8c7872d145e

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-PlwN7Brw6-diJkMCA8jH8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmII1JBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjNxlusW4G4Sfs2axcQm_ndZrUDYiEejikNtw6yCdy4s-cAs5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRmZ6BcXyBAQDWXj_e"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-PlwN7Brw6-diJkMCA8jH8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 268ms
114ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 260ms
112ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=2qefBCJ4X3-SUFZwwzP-9714e44eec&sid=DDTCAkIMb-6Gv8DNun-9714e44eec&cv=2.1.102-1-g48599ff&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:36 GMT
vary: Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
446 B 443ms
157ms XHR
application/json 34.193.179.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.179.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-179-5.compute-1.amazonaws.com
Software: /
Resource Hash: 6241de03a1e5b39cc35651850754fe564238b3dfacd13a1cede39b17e74ba85a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 400ms
138ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 36895
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: N79zUfrtXPX6_wAttpm4AiCyOxjeIC2P5dRyn_9UMFy6rEDIMN0XLw==
date: Tue, 27 May 2025 17:01:42 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 54798bbc2ce3e33c706761634ac87e48.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 401ms
133ms Script
application/javascript 108.138.106.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-59.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1595
via: 1.1 749177a97cae42477f22c33c927ca0ce.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: fuPsMQlk7eYKfWFXCt_l_071oyf6TcnlGtDHLeXkHVOHKhHKJA2DnA==
date: Wed, 28 May 2025 02:50:01 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 134ms
133ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 7889
access-control-allow-credentials: true
via: 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: rhR5GL9-Dk850Q8vErwAQ5y0Bch6TWaQSD86Kmy_G2-qtJbSNzD9jA==
date: Wed, 28 May 2025 01:05:06 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
376 B 782ms
478ms Fetch
application/json 108.138.105.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fcwqds.awadwatt.com%2F&pid=zNSYIgR5ORwrj&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=0488228c-08c5-4b1b-95dc-9468406ca5fe&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.105.211 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-105-211.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 264f765d2ad734b490f4728d6de8ce04.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: 9rIvhnDj8NEEED0j7E9X6xEP7sbX1fSEzHTwcKBKYZ8cxL5sGw8KjA==
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame CF87 1 KB
2 KB 213ms
65ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 999
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 02:59:57 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: ABgVH8-uRKHO0j2JLHWaU1Ne-iGiiNJR-p143OqL0b7u221zMjxBeLaCQnSSaS5YeOw_SUtFKRHP3Lw

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 141D 2 KB
1 KB 351ms
115ms Document
text/html 184.31.61.14
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.61.14 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-61-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=156611
content-encoding: gzip
content-length: 859
content-type: text/html
date: Wed, 28 May 2025 03:16:37 GMT
expires: Thu, 29 May 2025 22:46:48 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 251ms
159ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c963ed63778adada047ecbd72ba9c362460d4ed2581a3e2e775114e16b7aff8c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748402196&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zLvmVkonfld3guvkQS6%2FtqtWKH36tSWKUpFmYFCxmBU%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748402196&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zLvmVkonfld3guvkQS6%2FtqtWKH36tSWKUpFmYFCxmBU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 946a98224fbb2b5c-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 424 B
1 KB 787ms
699ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90c33d71ce893e19e7a1c865916d490e00ca2ff35f041e003103c0cef035e082

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748402196&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zLvmVkonfld3guvkQS6%2FtqtWKH36tSWKUpFmYFCxmBU%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748402196&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zLvmVkonfld3guvkQS6%2FtqtWKH36tSWKUpFmYFCxmBU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 946a98224fb92b5c-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 hbjson Show response
grid.bidswitch.net/ 0
189 B 1092ms
820ms Fetch 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:37 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 84 B
625 B 420ms
141ms Fetch
application/json 3.168.102.9
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-9.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: eb4dfb9afcafc2b99afd4875e9540f54ecd069034274a68bb4d0c6a3ea401ec3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 2
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 ce2e89e44d58ce842c3a3f58083fd886.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 109
x-amz-cf-id: 5JHG3kbn4xP6UbPt8KwN9bIG-edqEjwwDAWeeB3j3TkTzwa0fIiVkA==
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 400 auction Show response
elb.the-ozone-project.com/openrtb2/ 236 B
706 B 277ms
124ms Fetch
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6589f704aea9fcfe5d5fb76ec2827b5aeaa1b91d8e541f0c35a2b3de58a57983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 946a9822ce4808b2-LAX
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 236
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 238ms
95ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 438c5ad06acb78ab7b8ff32dd40f210893846e3642ae5f16fc9bd8092b103abd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.249
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain
vary: Origin

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 903ms
595ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:37 GMT
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
853 B 545ms
266ms Fetch
application/json 3.208.175.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.43.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-175-5.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory,sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
x-auction-status: 29, 29, 29, 29
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 395ms
133ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.43.0&cb=95445931450&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:36 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 700 B
1 KB 482ms
206ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=67950281-6bd5-45a2-ad06-a38e5ea4ecf6%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=488772dd-dfd2-41d1-b643-bf0915742df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.43.0&x_source.tid=4d86ba08-10f0-48d8-9722-c9e61612e034&l_pb_bid_id=986f332ad2dc915&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=69a0f189-bed5-4bbe-ac17-40978a1200d2&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.8510494896268345
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: af64b9219ca07a1a1b33165bc88c7fc61e813fa171e461b20756164a29465163

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
893 B 501ms
226ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=67950281-6bd5-45a2-ad06-a38e5ea4ecf6%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=488772dd-dfd2-41d1-b643-bf0915742df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=4d86ba08-10f0-48d8-9722-c9e61612e034&l_pb_bid_id=99699c115f7bf66&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=2bd0be48-4c34-4c1d-877f-bb89fe47e8d9&p_site.mobile=0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.1711779862441173
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: bf21027c8475b0519005e0512902f9b725d88124060cfde46c0ae3ecaf3141c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 538 B
1 KB 472ms
197ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=67950281-6bd5-45a2-ad06-a38e5ea4ecf6%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=488772dd-dfd2-41d1-b643-bf0915742df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=4d86ba08-10f0-48d8-9722-c9e61612e034&l_pb_bid_id=100b43cf965278348&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=326f81ef-a3bc-4208-9cb8-b8fa16561d6d&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.7185108987543926
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: b1281a2e7b89d3212fbf932572c87709a70443e59ade3b46f944f30075d242b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 538
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 538 B
898 B 473ms
199ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=67950281-6bd5-45a2-ad06-a38e5ea4ecf6%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=488772dd-dfd2-41d1-b643-bf0915742df9%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=4d86ba08-10f0-48d8-9722-c9e61612e034&l_pb_bid_id=10180afd2ba1ea8f8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=5f1abefa-0374-4683-b8f4-053ef3363a07&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.29676662006145504
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 9f83dbdd0ba19c57b4eec241c8541c35113977c941eff6f994336b4b3709f770

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 538
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 927ms
132ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
581 B 454ms
167ms Fetch
application/json 68.67.161.182
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 498fbdf0-6bb6-4810-af0c-a0ac83d8532e
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:37 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 39 B
669 B 174ms
92ms Fetch
application/json 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f785d18b9f3bcb2126cc425186a70aa8c1040cbb41bbe2502e07ef42f32807b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aAln9Bp6Ihq0wsIMZ9wrPXOlIxpVl9CGr1vJPeiaPSm%2BXdEbS1CAtFZB1MHHjzM76uSYZXOtOmloFIkLaX07qVi45vuxkkqbts2MUMOZk2Tvkh4zmmc3O9I3MEQHBGXjCqxjRRTd"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:36 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 946a98228af32efb-LAX
access-control-allow-origin: https://paint.toys
content-length: 39
server: cloudflare

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 809 B
844 B 634ms
338ms Fetch
application/json 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

f4cc389e069df0b4138388f6926c41a2355cb4f91a5c9849af7505ebb0ae87e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 488
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 828ms
535ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 553ms
264ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 549ms
262ms Fetch 44.193.15.84
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

44.193.15.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 317ms
100ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748402196783&to=600&aun=pw-160x600_atf&pubcid=67950281-6bd5-45a2-ad06-a38e5ea4ecf6&33acrossId=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=69a0f189-bed5-4bbe-ac17-40978a1200d2&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 318ms
102ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748402196784&to=600&aun=pw-160x600_btf&pubcid=67950281-6bd5-45a2-ad06-a38e5ea4ecf6&33acrossId=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=2bd0be48-4c34-4c1d-877f-bb89fe47e8d9&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 318ms
102ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748402196784&to=600&aun=leaderboard_atf&pubcid=67950281-6bd5-45a2-ad06-a38e5ea4ecf6&33acrossId=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=326f81ef-a3bc-4208-9cb8-b8fa16561d6d&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 319ms
103ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748402196785&to=600&aun=leaderboard_btf&pubcid=67950281-6bd5-45a2-ad06-a38e5ea4ecf6&33acrossId=v1.0014000001YrMoYAAV.1042.k%2FYGehSdXfAPc1L8JnpgU0gVQDnmf6izKyEPmBx71PBK5j2oCs%2BXVBZ6C3ruRN5jLpHt63MVy1%2Bozges7Ow8ANgcqRbY8vBPfurYrehca54t4EO%2B1atcwYad9sRMM2WnHRlYJjiH0bxRRauMeyoCOUqLxD1BzFSBDJfr9VjCWXZ8gvOyVZpjNeoSCQJ5HWXSbiGjt82Uh9spLx%2BkASlrxDLOFCxjzz5Y6j7C6XUR81TzWNvE0UiC7vmn8C2VmVEk0HHLIJOjHiO9ZLXnQ4Pq%2BW8MAO6IahSaYP8hb5W0YpYLz%2FL8aMNo9A5SO3vffvmYE%2B6l5KC7qYoSYLjpwCQ3Oq%2FqXja%2BDxMghj5AUnNNnmKoM37UreSTD96daPgiztnfcVdpSzaWCGIM2kr1%2FVSSKa%2FOnncAxT9%2FL1Y4kHRHRQ7n%2BD8RlJafOubqB00iKcUr0eUeqFOGj271t5iG5KmfAvkvIUBe43xHPKOzN5xJeKZpxjY8aKwssjU%2FNZ0BuFHmKuafhi%2F6J679x9%2B22%2BzoB32GSSY%2F3tE1AAIBKbVWofqswCnVDy9HXBqsB3TJ1JM79ttBTBdLv360CRaa5GBh3kgm%2BdpHlf2K4WkhETqCeuaAVoatPafJPkyTPD4v8ItD%2Bny2xXrzBcwZPqqbe3C2UVqbLIz%2BxTt7zDD6e4ciyIdXtIaR9HQJNSSKuDUFysu0En5I99XWIgmSqZfyZ%2FK4jT%2FD7J1sat4mHcNsCSFAatqVco0fIdZwvd6c4fiKJu6Ycam5QiNbHuGuRqtuTuOLIqeGZUZiysT8QkAEB49M%2BU7r1eu7hpWJfvVvP6rWie2NgPhd3tk%2Fj8qsihAOS6DM9a13UMO%2BjAhgCdwtJdJHrL51yKmyhcwW%2FhCW8IJLAoFSS9aLl5pjTmYi76QIF9C4YicpaZTRM31egY9%2Fn%2BphriE7a6dQx7SxwQWPIPAv8uU%2FbPtQkc52uUBtC3H25neTNwn6uCb39RWbySwjvv2Ok3ATOCW8Xac7rDvUlbToxsw2jSED5bvuJv%2BTQrSAWoIxLgiU9bPQCuN8%2FvEBE8zXN8j6YXuIIT%2F57r%2BmMtJhQOesPV%2BvkE7qKgbjCJMLbTDi1%2Fw9REwlqnPYycrTlMbGKC%2FF9vBc%2BPLbFXCXgIZ1yIxynCDWJdnMjOBctbBk8eAarDAYHuQRrHvpv1HniSi%2BHqJlBhllsr2Z95%2Bn0lOvBrIAGSUX4gvXrRgU80gzoXGwRhXVKYfWgrkNxPWXEI2Ufo%2BkL%2FA1fLSFrXNthxkvIibiHpKmgfwykuNx3DFYIRqG95BeLePLfD7cGUYNUSCQMChI0MGCFCDy8I38j%2Bt%2FBI64%2FqkuYM2Bnahj%2F%2FDjXs%2FHAkK4JAJx2hfKMXBwYVv3L3rEfzdnffW9l%2BwrYazJgEtxtz78fIvzsT0vNXZkjOC8dlwHJvtLQfIP7aImdsN3%2BMrsfFefJgS9Mi3msqipjLK8OgYBtiuZbIwABVEWD67ya5GDdVsH5Oyca10BJ1%2FzDqZlA32j1MV5acSHmzXhF68G&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=5f1abefa-0374-4683-b8f4-053ef3363a07&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 854ms
544ms Fetch 138.197.227.113
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.227.113 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 03:16:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 635ms
328ms Fetch 138.197.227.113
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.227.113 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 03:16:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 828ms
524ms Fetch 138.197.227.113
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.227.113 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 03:16:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 779ms
476ms Fetch 138.197.227.113
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.227.113 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 03:16:37 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 412ms
133ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Wed, 28 May 2025 03:31:37 GMT
accept-ranges: bytes
content-length: 17407
date: Wed, 28 May 2025 03:16:37 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 151ms
149ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 67218
via: 1.1 8ee187646f657ced7afa83005e9249cc.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 5h7NN88DcC2AFnLrD9ugsHNCiTNuUVNw9WZvuwWl6xvnuJqjqymQtg==
date: Tue, 27 May 2025 08:36:19 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 223ms
81ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3045
cf-ray: 946a98232e57f0e0-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Mon, 02 Jun 2025 03:16:36 GMT
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 230ms
81ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 16
expires: Wed, 28 May 2025 04:16:36 GMT
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
x-amz-id-2: ARTLOF8fvdJnwyqyxlCCsrr8nEuEGjLNVvlfOIL0Dbmn9IPS8Kd6yX6w43ZN1UEzGWEll+Brz2mHqyqopOErhh8GiGDyF7PNIW65mFnCJy0=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 9JYTHC4H5NNPE555
cf-ray: 946a982328302abb-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 406ms
131ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Wed, 28 May 2025 03:31:37 GMT
accept-ranges: bytes
content-length: 5252
date: Wed, 28 May 2025 03:16:37 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1748402196873&did=did-0046&se=e30&duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awad...
https://rp4.liadm.com/j?dtstmp=1748402196873&did=did-0046&se=e30&duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awa...

13 B
370 B

415ms
131ms

Fetch
application/json

18.213.23.22
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1748402196873&did=did-0046&se=e30&duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awadwatt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 18.213.23.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-213-23-22.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: d92816b2-548b-4cd4-a49a-4372408199ef
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1748402196873&did=did-0046&se=e30&duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awadwatt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjoz
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 03:16:37 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 669ms
129ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 436ms
126ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 441ms
131ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame A910 0
100 B 579ms
377ms Document
text/plain 44.235.139.86
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.235.139.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-139-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Wed, 28 May 2025 03:16:37 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlRRLUZEbXBiY0ZBVzAtd2xkVTYybDRsQm1LYVJTam85VlNsbkIyd28wOTQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MlRRLUZEbXBiY0ZBVzAtd2xkVTYybDRsQm1LYVJTam85VlNsbkIyd28wOTQ&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

234ms
129ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:37 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Wed, 28 May 2025 03:16:37 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&bid=1e2n4ou

70 B
440 B

135ms
135ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:38 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&bid=1e2n4ou
content-length: 191
date: Wed, 28 May 2025 03:16:37 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-pvUSPO9E2pXOpjGaJjtrfzNX4c68epwrZIs-~A&gdpr=0

70 B
440 B

139ms
134ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-pvUSPO9E2pXOpjGaJjtrfzNX4c68epwrZIs-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:37 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-pvUSPO9E2pXOpjGaJjtrfzNX4c68epwrZIs-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8611986256950480670&newuser=1&referrer_pid=m51mh00

70 B
440 B

129ms
129ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8611986256950480670&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:37 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8611986256950480670&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 03:16:36 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=8773561909851179247&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

267ms
133ms

Image
image/gif

54.156.26.12
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=8773561909851179247&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 54.156.26.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-156-26-12.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 03:16:37 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=8773561909851179247&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ada9bade-187c-494c-bbea-251e6e4c7448
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 414ms
125ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 03:16:37 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 171714
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 278ms
93ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 1102
cross-origin-resource-policy: cross-origin
cf-ray: 946a9825fe790fdc-LAX
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 28 May 2025 01:04:55 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
268 B 110ms
110ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6058099bc0ef86bd9a556839d732601211a2031c89938a0790a5387881c72df9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 946a98265eac2a8c-LAX
access-control-allow-origin: *
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 265ms
94ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 946a9825cdad2a8c-LAX
content-length: 0
content-type: text/plain
date: Wed, 28 May 2025 03:16:37 GMT
expires: Thu, 28 May 2026 03:16:37 GMT
server: cloudflare

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 145ms
145ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Wed, 28 May 2025 03:31:37 GMT
accept-ranges: bytes
content-length: 17042
date: Wed, 28 May 2025 03:16:37 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 AGSKWxV9sXO2RLJQZZqePb0Y9aShYLejwBsJgaNQ4sCIFm7Az_d0aI9l0PUJ1sWE4NT00TTdGMLIo2rHrGMXcarUme4f008S_GIDHhzL5_lxU4OV0OIg4cqK6yiT0QBKtipncHmk8-9wMA== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 175ms
173ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV9sXO2RLJQZZqePb0Y9aShYLejwBsJgaNQ4sCIFm7Az_d0aI9l0PUJ1sWE4NT00TTdGMLIo2rHrGMXcarUme4f008S_GIDHhzL5_lxU4OV0OIg4cqK6yiT0QBKtipncHmk8-9wMA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDAyMTk3LDM2MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJnUFJEME5GZXE1SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJjd3Fkcy5hd2Fkd2F0dC5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7bcde126916d55249cf76c95caa7c35d9ef145fbac10139f36d03288f1727669

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-IChE6W4njqMQ5w_Wo35Htw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw15BiOHHrNtMFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F418ZbrIeBuEn7NmsXEJv53Wa1A2IhHo6pDbcOsgnM-LbtFqOSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGpkZmegXF8gQEA_mBE8w"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-IChE6W4njqMQ5w_Wo35Htw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 4327 102 KB
28 KB 400ms
135ms Document
text/html 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1842
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 02:45:55 GMT
expires: Wed, 28 May 2025 03:35:55 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 443ms
137ms Script
application/javascript 2600:9000:24f1:8400:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:8400:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 1261
x-cache: Hit from cloudfront
x-amz-cf-id: XbviRdh-1tW5jIi6ghus9OsevyIRCUk46ecNRejRrC3Kg-92HbG8lg==
date: Wed, 28 May 2025 02:55:37 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 8ee187646f657ced7afa83005e9249cc.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 235ms
66ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 22380
x-goog-stored-content-encoding: gzip
expires: Wed, 27 May 2026 21:03:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 27 May 2025 21:03:37 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: ABgVH88PbEhc4KNqtq7ttq1VkVdwKKf_1aitr_XckGqx8XMrZByumb4ka0fQAIrn39jPBUA
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 407ms
234ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: d03ab80a1f455c14a751ab34e5acdc96

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 245ms
82ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 138851
cf-ray: 946a9826cb0b2eed-LAX
expires: Sat, 31 May 2025 03:16:37 GMT
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 532ms
255ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Thu, 29 May 2025 03:16:37 GMT
access-control-allow-origin: *
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 435ms
136ms XHR
application/json 2606:ae80:1451:18::1780
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:18::1780 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Wed, 28 May 2025 03:46:37 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2 200 AGSKWxV6iUvvpPTQzm7eoBfdFSYARG4St8wgMfAT4gLpydfhIg9OSKENsjUWIuIh4PS8YDEgD7TNLH999ottTvEDOoof6te79UrsR3PRD-cTNxXL-rXLAi4v7rhgTIm62_kk7Wxuq8p37Q== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 175ms
175ms Script
application/javascript 2607:f8b0:4006:824::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV6iUvvpPTQzm7eoBfdFSYARG4St8wgMfAT4gLpydfhIg9OSKENsjUWIuIh4PS8YDEgD7TNLH999ottTvEDOoof6te79UrsR3PRD-cTNxXL-rXLAi4v7rhgTIm62_kk7Wxuq8p37Q==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDAyMTk3LDU0NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiZ1BSRDBORmVxNUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiY3dxZHMuYXdhZHdhdHQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:824::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

779196148c51cc8baf0666bb2e90bba1ff00ca3d58440c84e2b7902ff6fdc819

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-oxUv19rQ-g0QNytVZMJYWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw1pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgbhnyS3WKUC8ZuMt1q1A3KR9m7ULiM38brPaAbEQD8fUhlsH2QR-vP-5gUlJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyEzPwDi-wAAAS8ZEXg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-oxUv19rQ-g0QNytVZMJYWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame 6DE3 0
412 B 407ms
130ms Document
text/html 44.218.45.187
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.218.45.187 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-218-45-187.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Wed, 28 May 2025 03:16:37 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 244ms
81ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10c0d08c9ddb0dece1c1a2499d1b9a6913d43283165ccbcfcbe0911273000af3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 12082
cf-ray: 946a98289d0278d4-LAX
date: Wed, 28 May 2025 03:16:37 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 27 May 2025 15:55:25 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
170 B 316ms
120ms Image
image/gif 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&halo_id=060ixeeju6a659966666666666666666666uommwi0e0y66000000000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a9828d8ba69a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:37 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 303ms
97ms Image
text/html 35.161.193.79
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.161.193.79 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-161-193-79.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&adnxs_id=8773561909851179247&gdpr=0

43 B
95 B

123ms
123ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&adnxs_id=8773561909851179247&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982a1ac469a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&adnxs_id=8773561909851179247&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9c037354-c0bb-4ee5-a1d4-82b373255b40
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:37 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748402198-PRIIQJN3-ZD94%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748402198-PRIIQJN3-ZD94%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=07be0610-c6aa-4313-b15a-7d0cfa49b779&id=AU1D-0100-001748402198-PRIIQJN3-ZD94&auid=AU1D-0100-001748402198-PRIIQJN3-ZD94

43 B
95 B

119ms
119ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=07be0610-c6aa-4313-b15a-7d0cfa49b779&id=AU1D-0100-001748402198-PRIIQJN3-ZD94&auid=AU1D-0100-001748402198-PRIIQJN3-ZD94
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982a9b5f69a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=07be0610-c6aa-4313-b15a-7d0cfa49b779&id=AU1D-0100-001748402198-PRIIQJN3-ZD94&auid=AU1D-0100-001748402198-PRIIQJN3-ZD94
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:37 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748402198-PRIIQJN3-ZD94
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748402198-PRIIQJN3-ZD94
https://ids.ad.gt/api/v1/pbm_match?pbm=11C77F96-3060-4C47-9E09-C8557DF5AB53&id=AU1D-0100-001748402198-PRIIQJN3-ZD94

43 B
118 B

161ms
161ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=11C77F96-3060-4C47-9E09-C8557DF5AB53&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a9832abe269a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=11C77F96-3060-4C47-9E09-C8557DF5AB53&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:39 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001748402198-PRIIQJN3-ZD94&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&rub=MB7DIXDA-1F-HL4W&gdpr=0

43 B
95 B

130ms
130ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&rub=MB7DIXDA-1F-HL4W&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982b0bdf69a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&rub=MB7DIXDA-1F-HL4W&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 91c229169a155ea648dbc4d59ef8a3c5
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748402198-PRIIQJN3-ZD94&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748402198-PRIIQJN3-ZD94&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&id=AU1D-0100-001748402198-PRIIQJN3-ZD94

43 B
95 B

130ms
129ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a9829faa669a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
content-length: 259
date: Wed, 28 May 2025 03:16:37 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001748402198-PRIIQJN3-ZD94&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748402198...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001748402198-PRIIQJN3-ZD94&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=286cb495-c3fe-48c9-b711-5cd836846dfc%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&ttd_puid=286cb495-c3fe-48c9-b711-5cd836846dfc%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&tapad_id=286cb495-c3fe-48c9-b711-5cd836846dfc

43 B
95 B

125ms
125ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&tapad_id=286cb495-c3fe-48c9-b711-5cd836846dfc
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982dbe9b69a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&tapad_id=286cb495-c3fe-48c9-b711-5cd836846dfc
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Wed, 28 May 2025 03:16:38 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
243 B 149ms
149ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001748402198-PRIIQJN3-ZD94

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:37 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001748402198-PRIIQJN3-ZD94
https://ids.ad.gt/api/v1/amo_match?turn_id=8611986256950480670&id=AU1D-0100-001748402198-PRIIQJN3-ZD94

43 B
94 B

195ms
132ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=8611986256950480670&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a9828d8c169a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:37 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=8611986256950480670&id=AU1D-0100-001748402198-PRIIQJN3-ZD94
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 03:16:37 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&uid=0f931811-d85d-4e58-b34b-d7ae58d86771&gdpr=0

43 B
95 B

117ms
117ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&uid=0f931811-d85d-4e58-b34b-d7ae58d86771&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982bac9669a9-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748402198-PRIIQJN3-ZD94&uid=0f931811-d85d-4e58-b34b-d7ae58d86771&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 28 May 2025 03:16:38 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-138
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001748402198-PRIIQJN3-ZD94
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQwMjE5OC1QUklJUUpOMy1aRDk0

170 B
188 B

153ms
152ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQwMjE5OC1QUklJUUpOMy1aRDk0

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:38 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 946a9829395a69a9-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQwMjE5OC1QUklJUUpOMy1aRDk0
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
447 B 275ms
273ms Fetch
text/plain 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3249663.ip-57-129-85.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 03:16:37 GMT
content-type: text/plain;charset=utf-8
vary: Origin

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 655ms
214ms Fetch
application/json 2001:41d0:701:1000::4c1f
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::4c1f , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: b4c7a4ef0c7259cda30fafbe6ad8b2b6628672f835f95172b8a6ef692494a574

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 1618ms
1120ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

87cdc23eac75fd506d4573162c33781ccdf43d967dd5f59a4d51d5e8a80f0447

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 405ms
257ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: fee83274d9c13e60f4dadf3e8e019bfef724c6f7c49133a9937ebf01b9d64fa8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json
x-cloud-trace-context: ad018244bbf36788d795214ac34ec829
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 129 KB
44 KB 736ms
735ms Fetch
text/plain 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=349948679836050&correlator=3915950253252855&eid=31092253%2C95353385%2C83321072&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1748402197855&lmt=1748402197&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=9&tps=9&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDY3OTUwMjgxLTZiZDUtNDVhMi1hZDA2LWEzOGU1ZWE0ZWNmNlgBEj4KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHGFDMDVMdEhNNEpNQUF6WENBTXpOZGdBQSY0NDVYARI3Cg1iaWRzd2l0Y2gubmV0EiRlZjQzODQxMi00ZTE1LTRmOGItYmI2Ni1iOTJlYjczMDhkZTFYARIdCg5lc3AuY3JpdGVvLmNvbRiAp5Gn8TJIAFICCGQSGAoJeWFob28uY29tGMKqkafxMkgAUgIIbxIUCgVvcGVueBj5qJGn8TJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGICnkafxMkgAUgIIZBIXCghydGJob3VzZRiAp5Gn8TJIAFICCGQShwEKDmxpdmVpbnRlbnQuY29tEnMxNi0xdVFyV3krV1JCMHpQaHdVVHNIc3NFam5lTUZzeVVQWFR6dEozS1dIbWZ1RGJYaHBGY0dLaGFtbmpwTGgxV1BxajlGTWhLWEN3Qjd1WG5hblplelo2WkhVdHpXVUUrQnkzUmZGRHdHbWlGQ3Vudz09WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1748402194920&idt=1547&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D19e7586d22bf4518b27656f90b9be58102196623%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fcwqds.awadwatt.com%252F%26tyche_code%3DV.20250527.5%26pageos_code%3DV.20250527.5%26config_id%3D1024872_74068_primary_config%26hour%3D17%26day%3DTuesday%26referrer_domain%3Dcwqds.awadwatt.com%26OS%3DLinux%2520null%26browser%3DChrome%2520136%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250527.5%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=51502&tan=c2dbd795-4249-465a-8d29-2e3b21c9ebfc&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3249663.ip-57-129-85.eu

Software

cafe /

Resource Hash

5152c173256e2400d68366dfb880eedf554e15c61c63500851a6aab00a01bec0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 45503
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 04E6 7 KB
3 KB 440ms
146ms Document
text/html 142.250.64.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.97 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 03:16:38 GMT
expires: Wed, 28 May 2025 03:16:38 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 133ms
133ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Wed, 28 May 2025 03:31:37 GMT
accept-ranges: bytes
content-length: 67550
date: Wed, 28 May 2025 03:16:37 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
114 KB 154ms
154ms Script
application/javascript 142.250.65.200
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.200 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5c162310daebac87bb492332d2b9fb63e11b1e2f195e857708cf16ea578f918d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 03:16:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 116651
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 443ms
252ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 946a982a79ac9091-LAX
date: Wed, 28 May 2025 03:16:38 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 176ms
175ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 946a982949160fdc-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 415ms
112ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946a982b6c2a7cef-LAX
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:38 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 700 B
251 B 129ms
127ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf4bf3070f587e2e4e243787cc361acd3fd1c38a993ba148dfb4460e0d2ef306

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 946a982c0ef39091-LAX
access-control-allow-origin: *
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame DA55
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid...

2 KB
1 KB

90ms
89ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 228d01104e7307d18ad06dff209a09da03cbd66ccf9f1681d41ed46fb8eef2cf

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 946a982ada48f434-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 03:16:38 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OmYqd%2FMXRZNcKyct5yi2LEMOExnD5hbVTchuv1mx8%2Bo3NMTR%2Fyh%2BrImt6vwY4BAaE5ohHWaEBs%2F9%2F4Oz%2F1FzRhn3me8deE%2FII%2BG7sYaL1blM4RPbMiiIIGRgrlooH13kwsDJcuWOhQ52Ww%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 946a982a3809f434-LAX
content-length: 0
date: Wed, 28 May 2025 03:16:38 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CF2VNXNYbhYfX%2B3lpAmU1nkg4O46DyTACx97MkLvePWYsy3vBYgfdAFPEuiGNm1KodBykepjSn420mUPgNmzbNdQTQ2Q1Ll39X4YqIPypsoZHCkG%2BCaRpsL5D%2FsGh85ygKmRcaJKhybPyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 1562ms
218ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

87cdc23eac75fd506d4573162c33781ccdf43d967dd5f59a4d51d5e8a80f0447

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame DA55 170 B
409 B 824ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&gdpr_consent=&us_privacy=1NNY&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sync
thrtle.com/ Frame DA55
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aDaAFsAoIngAFq4kAlfb9QAA%262631&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&us_privacy=1YN-&us_privacy=1NNY
https://thrtle.com/sync?_reach=1&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&vxii_pid=12&vxii_pid1=7006&vxii_rcid=ef32d9e8-a797-445c-bb5c-82b5e777611f&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=qjqjgpAhWFVWkYkPD5nQCKL1zvk&_t=1748402200
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A

43 B
537 B

133ms
132ms

Image
image/gif

54.158.211.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Server: 54.158.211.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-211-207.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 03:16:40 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame DA55
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

155ms
155ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: C3CZRHNX1XW87F6272SB
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 03:16:39 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: DGAEQ4GJQKX5PAGTNXDK
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 03:16:39 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DA55
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&expiration=1750994198&gdpr=0&gdpr_consent=

43 B
766 B

98ms
97ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&expiration=1750994198&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZoHtiqI56ClAZHfroGCdW1%2B42e5ZnPUeFzIKB885MHVmq3huiCDxzkgeHQ%2FDFsz8YxLYTVryjRHNWd5jeryOPwQFlJWW0ng55EAUmlhCYPyrSYqU29LlwS%2BlzuJuTqQC%2FJbL69f73TTgOw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a98313f2df434-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&expiration=1750994198&gdpr=0&gdpr_consent=
content-length: 323
date: Wed, 28 May 2025 03:16:38 GMT
server: Kestrel

GET
H2 200 aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame DA55 43 B
520 B 928ms
131ms Image
image/gif 2600:1f18:4e9:5a02:c019:9703:677b:fd3b
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB?gdpr_consent=&us_privacy=1NNY&gdpr=&gpp=&gpp_sid=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:c019:9703:677b:fd3b Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DA55
Redirect Chain

https://ad.turn.com/r/cs?pid=21&us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8611986256950480670

43 B
765 B

79ms
78ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8611986256950480670
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A0D%2BkUkXpxsU2IvqDTTKO5rxhkYUiMA3GBftK87En%2F%2BkteQoiLaLEyNu%2BEv1T%2BamJ7XYP5szM7xYoLohsBjTOKLf11Mc0fZZ5xe5fkGFlKqBIhMDVjhDlWKQG2hQfaUia0aKGdfIDmhqWg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a982ffb4ef434-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8611986256950480670
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 03:16:38 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DA55
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDaAFsAoIngAFq4kAlfb9QAA

170 B
232 B

729ms
155ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDaAFsAoIngAFq4kAlfb9QAA

Requested by

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=90TA9FS9a29wK7mfqAv7L8YGGIzG4r9VzleiiDX%2B2cPmTvHhFK8Kj1fmVE59Xrlc6mlSdtevPwLwqLb6wqNlHvtlgUYC8O1BvExM4yM6XhsCU9Tb%2BO4BmlhWxuq4z4VPKTolspz7KEUpCA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:38 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDaAFsAoIngAFq4kAlfb9QAA
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a982b8c99f434-LAX
content-length: 0
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DA55
Redirect Chain

https://s.c.appier.net/index?userId=aDaAFsAoIngAFq4kAlfb9QAA%262631&gdpr=&us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=dUEQsPJcCXiEAVmDF4A2aA&gdpr=0

43 B
769 B

81ms
81ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=dUEQsPJcCXiEAVmDF4A2aA&gdpr=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QoLhRiDtO5Zad4%2F4fSYBuZVRtgZEoAfo1gZhNL%2BwvwOmZSdyupKjLBsVCAlU6kxv7q3A9C6T2OUZs7sTCuErWBNRF3L14w%2FCUgu5mWp2ywF%2FCicUk8yDQwWCZU%2BgOHyF9SlAs49oCVM%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a9830bd8ff434-LAX
content-length: 43
server: cloudflare

Redirect headers

Cache-Control: no-store
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=dUEQsPJcCXiEAVmDF4A2aA&gdpr=0
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Wed, 28 May 2025 03:16:39 GMT
Server: nginx

GET
H3 200 setuid
prebid.intergient.com/ Frame DA55 0
825 B 396ms
323ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aDaAFsAoIngAFq4kAlfb9QAA%262631
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748402198&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1GAnoitxhSyVarE96XCg%2Fr9VcUa8ADGW58CLD2OHGd4%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:38 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748402198&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1GAnoitxhSyVarE96XCg%2Fr9VcUa8ADGW58CLD2OHGd4%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946a982bfd6e2f20-LAX
server: cloudflare

GET
H3 200 468_60&adnum= Show response
fundingchoicesmessages.google.com/f/AGSKWxU8qNLOndJ7UGgeWBiQmly8TcNgw_Ct-Ic72-29PG_suHW4PHQ1exIYRe87yLMkjPkFY1JobtxJ6We6Fcj-_lZnJVhgD0PZZQrIpOBn32s0DTo8f1VA12BjY_d5kpSlyE-E9RleIsq8atysnYOEcSO-a8lZa... 54 B
109 B 169ms
168ms Script
application/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxU8qNLOndJ7UGgeWBiQmly8TcNgw_Ct-Ic72-29PG_suHW4PHQ1exIYRe87yLMkjPkFY1JobtxJ6We6Fcj-_lZnJVhgD0PZZQrIpOBn32s0DTo8f1VA12BjY_d5kpSlyE-E9RleIsq8atysnYOEcSO-a8lZabDgnAU5B84jQb_0orPPaYzEz48_0JYT/_/marfeel_sw./sidead2./forum/ads_/img/468_60&adnum=

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d656248940158bae9f50d1d15a80343fbbc450b7910d26bdb131bf8cda07f665

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bVlUF_A8h47WDLQpkVtjRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0ZBiaL15jnUqEBsqXGJ1BOL76y6xPgfiD_WXWX8AcZHEFdYmIP5UdYNVqPoGaxL7TdYiIA51vMkaC8JpN1lTgXjXxlush4C4Sfs2axcQm_ndZrUDYiEejmkNtw6yCXx4fewco5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRmZ6BcXyBAQDiHkAp"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-bVlUF_A8h47WDLQpkVtjRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 420ms
147ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f2.1e100.net

Software

cafe /

Resource Hash

423edce05107736ae54bd103523ac3260b302913c40cfff8d3f4082708967e24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4307315905198946986
age: 1090
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:58:28 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 02:58:28 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 80885
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUSXPrFbjvIUbPDeX4A4NzbPoZEb8wGW4mgSZVkai8NGbSJtMbQA7QDTBN7PDDhy8d8auurYrYm2NbNqbJJLEaT-xsrWLIoF725dMxZZO1wQKC3pMrRl8MrlFDS1V05AqbezgXzeA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 321ms
170ms XHR
text/html 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUSXPrFbjvIUbPDeX4A4NzbPoZEb8wGW4mgSZVkai8NGbSJtMbQA7QDTBN7PDDhy8d8auurYrYm2NbNqbJJLEaT-xsrWLIoF725dMxZZO1wQKC3pMrRl8MrlFDS1V05AqbezgXzeA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-O6yTZzwWJXsm3y0m3762cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:38 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2IhHo5pDbcOsgmcuLZxKpOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLTMzCPLzAAAIuRJ1Q"
content-security-policy: script-src 'report-sample' 'nonce-O6yTZzwWJXsm3y0m3762cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 784C 5 KB
2 KB 788ms
88ms Document
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 2472
apigw-requestid: LQaw-gzhvHcEJZg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 946a98314a29090a-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 03:16:39 GMT
last-modified: Wed, 28 May 2025 02:14:55 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUSXPrFbjvIUbPDeX4A4NzbPoZEb8wGW4mgSZVkai8NGbSJtMbQA7QDTBN7PDDhy8d8auurYrYm2NbNqbJJLEaT-xsrWLIoF725dMxZZO1wQKC3pMrRl8MrlFDS1V05AqbezgXzeA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce--QFzB-Ay51RfR_FIMkvzqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:38 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII0pBi-FB_mfUHEJv53Wa1A2IhHo5pDbcOsgnc6Pown0nJJSm_MD45P68kNa9ENzGlWBfELspMKi3JL0Jhp5aBVOTkp6dn5qXHGxkYmRqYGpnpGZjHFxgAAJRYJ24"
content-security-policy: script-src 'report-sample' 'nonce--QFzB-Ay51RfR_FIMkvzqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 295ms
157ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3 200 container.html Show response
82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 198A 7 KB
0 0ms
0ms Document
text/html 142.250.64.97
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.97 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s31-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 03:16:38 GMT
expires: Wed, 28 May 2025 03:16:38 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 9D48 0
0 431ms
136ms Document
text/plain 137.184.23.100
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.23.100 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Wed, 28 May 2025 03:16:39 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame BA30 269 B
379 B 413ms
131ms Document
text/html 23.56.163.141
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.141 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-141.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 28 May 2025 03:16:39 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 88B0 20 KB
7 KB 108ms
107ms Document
text/html 184.31.61.14
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.61.14 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-61-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=102588
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 28 May 2025 03:16:38 GMT
expires: Thu, 29 May 2025 07:46:26 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

sync Show response
eb2.3lift.com/ Frame F00D
Redirect Chain

https://eb2.3lift.com/sync?us_privacy=1NNY&
https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

1 KB
2 KB

142ms
142ms

Document
text/html

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: b3af2b28e939cf472824d0e1c7bea0c99b5edb112372690abe3a27ca07d18bb0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:39 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
location: /sync?us_privacy=1NNY&&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 05B8 52 KB
17 KB 668ms
217ms Document
text/html 151.101.1.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 69049
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 28 May 2025 03:16:39 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1170132, 356957
X-Served-By: cache-lga21993-LGA, cache-toj-leto2350038-TOJ
X-Timer: S1748402200.500127,VS0,VE0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 0BCE 803 B
1 KB 252ms
91ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e466d77531e8df3874a2cf683cb689c2ff9bf4aff549ef0ec6bf72600fd2cc25

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Wed, 28 May 2025 03:16:38 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame C817 2 KB
1 KB 367ms
122ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 03:16:38 GMT
server: Kestrel
server-processing-duration-in-ticks: 87585
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 8DD5 3 KB
2 KB 215ms
73ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 552
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 946a98307e6d3a6b-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 03:16:39 GMT
expires: Wed, 28 May 2025 07:16:39 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 127ms
123ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=G4YZ6l9VdEJSdkVWJTJGdk1RYzBSZXI5aGF4MUlIcmhOTmdSbjc4WFdUZ1pGUlclMkZmcGdlcERaSEVEejR0d2F0Vk9weDRZdHB6ckNLSHFsRzIlMkZONkRtYmc1eU5jTFg0Z3lNSGttV3piRzU5SEVyMFEzVDljT0ZoejRpWVhKZ3F3b1NmcnJTYg&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 03:16:38 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 312466
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 228ms
225ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-240-179-120.us-west-2.compute.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 96ms
95ms Fetch
application/javascript 52.24.167.218
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.24.167.218 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-24-167-218.us-west-2.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: eec793f0b9cb7a4e0d11082123fa5a7501b5d476ad6095f7f0b38aba7b295537

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 102ms
97ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0&us_privacy=1NNY&tp=mOowFfmjN9UswrZ%2F6pU2UDuj4423yo0vRlk2MCj8%2FS0%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 702109fb3db54a8c50d3266022474083c66c7b8929d9e90a3cc8b60c5d03cefa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 217 B
0 3ms
3ms Fetch
text/plain 34.227.131.32
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwae8kwcfj7sgvvkxf4a728s&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.227.131.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-227-131-32.compute-1.amazonaws.com
Software: /
Resource Hash: eb1c47f64be47959f0564a4b01ab35778a42d92f1da4b408943a3f0dd4bcaced

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: a9f564ee91584991
request-time: 4
access-control-allow-credentials: true
expires: Thu, 29 May 2025 03:16:36 GMT
access-control-allow-origin: https://paint.toys
content-length: 217
date: Wed, 28 May 2025 03:16:36 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 128ms
127ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 229580
expires: 0
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2 200 sync
x.bidswitch.net/ 43 B
183 B 435ms
139ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

GET
H2

200

ibs:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1

42 B
717 B

101ms
98ms

Image
image/gif

44.240.179.120
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

44.240.179.120 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-usw2-1-v073-0d0eb2a30.edge-usw2.demdex.com 5 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: EQNpSYorTFQ=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1
content-length: 189
date: Wed, 28 May 2025 03:16:39 GMT
server: Kestrel

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A7D1 652 B
254 B 427ms
154ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiBxO60AjAB&v=APEucNVAQDgIF5Nar8RIAB0aUnbHPQRm-85IzkPj-rQKVc13UlHV5jt4PP4OxgSX4GSJM5Ec8bpv6vDOmuEU4biKAp4-0is2eac3Dltr2_YB4_ywuW9uv-c

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 03:16:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 198A 477 KB
96 KB 449ms
144ms Script
text/javascript 2600:141b:1c00:44::17db:2453
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/eefppujattfxkeclpujkvfRNnpyUEVUeXdTdmdnaEV1NkZOczQtMzE3NS0yNjczMDEyNS0wZmNkMDI2Yi00OTIxLXk3NzhCeThJaEJ0V3dEMklmbGpP/o4y5aytugvod7i2ouzvr2afwqwot37/ivfasjovfyyczpzfgbfttt/5g5fvjmkwvpx7
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:2453 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: f29fb5dfb2032376b822c3e17842ac48b5fbb0e79d7057e887cb5c02105decf5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "ace467a03fcafbcadd94745fde4d8033"
Connection: keep-alive
Expires: Wed, 28 May 2025 03:31:39 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 97452
Date: Wed, 28 May 2025 03:16:39 GMT
Content-Type: text/javascript
Last-Modified: Mon, 26 May 2025 10:10:42 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 198A 117 KB
41 KB 430ms
131ms Script
text/javascript 2607:f8b0:4006:81d::2006
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81d::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 43214
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 28 May 2025 15:16:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 27 May 2025 15:16:25 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/elements/html/ Frame 198A 8 KB
3 KB 592ms
331ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 567199331036499589
age: 40114
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 16:08:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 16:08:05 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/ Frame 198A 21 KB
8 KB 381ms
129ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be507b359cc4919d2c1154e11c9d17b94ba03bc583f0d31fffc3525583bec00d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 5251608839672234903
age: 5525
x-content-type-options: nosniff
expires: Wed, 11 Jun 2025 01:44:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 01:44:34 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8642
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 198A 41 KB
14 KB 456ms
157ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2446
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:25:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 02:35:53 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/ Frame 198A 3 KB
1 KB 560ms
261ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/window_focus_fy2021.js

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 40200
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 16:06:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 16:06:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BC26 1 KB
643 B 380ms
131ms Document
text/html 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 47177
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 27 May 2025 14:10:22 GMT
etag: 48472445140208031
expires: Wed, 28 May 2025 14:10:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/ Frame 198A 19 KB
8 KB 428ms
131ms Script
text/javascript 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

760e5d0b97d6707a3d5c2c949bd70e7668484a144f383f3a4dfa878bad15e8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 3000748235154339481
age: 40763
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 15:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 15:57:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 198A 42 B
63 B 587ms
338ms Image
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DJoR0TRCQPPbGyfnftC8GSeHqdGekuSIzEFYTBYFx_uiuhQYwtQXnMq1c3BdP3U-tz4JMpKCHNZ3fSCvZmeiIl3jzJ1UDSXswNUFYRuf4wb5wER9o

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET l
www.google.com/ads/measurement/ Frame 198A 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 198A 221 KB
68 KB 381ms
133ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fc89654aff6bca6c890b30bd0833eb2f18d63a61c0a9ece5246537ad6f73c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 81102085050987160
age: 3593
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:16:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 02:16:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69707
x-xss-protection: 0
server: cafe

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9EB4 20 KB
7 KB 109ms
109ms Document
text/html 184.31.61.14
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=1NNY&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.61.14 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-61-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=102587
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 28 May 2025 03:16:39 GMT
expires: Thu, 29 May 2025 07:46:26 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUSXPrFbjvIUbPDeX4A4NzbPoZEb8wGW4mgSZVkai8NGbSJtMbQA7QDTBN7PDDhy8d8auurYrYm2NbNqbJJLEaT-xsrWLIoF725dMxZZO1wQKC3pMrRl8MrlFDS1V05AqbezgXzeA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NrsWmcObvXCPscsdmOhctQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2Ihbo7pDbcOsglsuHzMUMklKb8wPjk_ryQ1r0Q3MaVYF8QuykwqLckvQmGnloFU5OSnp2fmpccbGRiZGpgamekZmMcXGAAAXzMm6A"
content-security-policy: script-src 'report-sample' 'nonce-NrsWmcObvXCPscsdmOhctQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUSXPrFbjvIUbPDeX4A4NzbPoZEb8wGW4mgSZVkai8NGbSJtMbQA7QDTBN7PDDhy8d8auurYrYm2NbNqbJJLEaT-xsrWLIoF725dMxZZO1wQKC3pMrRl8MrlFDS1V05AqbezgXzeA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vvsL76aTur0CQf2Jqn19ZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2Ihbo7pDbcOsgkc6FpqqOSSlF8Yn5yfV5KaV6KbmFKsC2IXZSaVluQXobBTy0AqcvLT0zPz0uONDIxMDUyNzPQMzOMLDABFuiaO"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-vvsL76aTur0CQf2Jqn19ZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxV93quCVwm48sdUZ6lGnQA8_hAGCCUukF82y2xHuYiHpdpP73E4xMvvrS6rL23TpwkCvCrPcA5kVbxAPAXQvrU_Gd4HBwdIBNXcRTZ77g8dDVGe9Tlx_pjuk6LmvueBby48IBGnXw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 165ms
164ms Script
application/javascript 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV93quCVwm48sdUZ6lGnQA8_hAGCCUukF82y2xHuYiHpdpP73E4xMvvrS6rL23TpwkCvCrPcA5kVbxAPAXQvrU_Gd4HBwdIBNXcRTZ77g8dDVGe9Tlx_pjuk6LmvueBby48IBGnXw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDAyMTk5LDI5MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5LDZdLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsImdQUkQwTkZlcTVJIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsImN3cWRzLmF3YWR3YXR0LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3249663.ip-57-129-85.eu

Software

ESF /

Resource Hash

c460ab6c226c78a4a9bb6e8ebb94af31c05b6724994a762254563711a171bfb2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Ckgby1KXM9DiNRQrMvfkcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:39 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw0JBiaL15jnUqEBsqXGJ1BOL76y6xPgfiD_WXWX8AcZHEFdYmIP5UdYNVqPoGaxL7TdYiIA51vMkaC8JpN1lTgXjXxlush4C4Sfs2axcQm_ndZrUDYiFujukNtw6yCfy4cdFCSSMpvzA-OT-vpCgzqbQkvygtOS21OLWoLLUo3sjAyNTA1MhMz8A4vsAAAI-mP4Y"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Ckgby1KXM9DiNRQrMvfkcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 88B0 5 KB
6 KB 420ms
130ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=85299058&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0bf53594345405af2705d6da203fae47eb7b97677da6dcac9b819e8c8cc22c2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

sync Show response
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f...
https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f...

1 KB
2 KB

143ms
142ms

Document
text/html

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: ef212e752c45930865e4347486cfd1911c46316b7dbf84351338e48966d73a31

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1235
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:39 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
location: /sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 671ms
218ms Fetch
application/json 57.129.85.132
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

57.129.85.132 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

87cdc23eac75fd506d4573162c33781ccdf43d967dd5f59a4d51d5e8a80f0447

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 03:16:38 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 0BCE 170 B
232 B 152ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 0BCE 170 B
232 B 151ms
149ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDI5MWNjYmYtODY1MS0yMjRiLWY3NDEtMzNlNTI3ZDRiNjFk

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0BCE
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=2efe1f75-4f26-7cef-e2a1-695ced36787d&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&ttd_puid=2efe1f75-4f26-7cef-e2a1-695ced36787d&gdpr=0&gdpr_consent=

43 B
240 B

100ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&ttd_puid=2efe1f75-4f26-7cef-e2a1-695ced36787d&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&ttd_puid=2efe1f75-4f26-7cef-e2a1-695ced36787d&gdpr=0&gdpr_consent=
content-length: 335
date: Wed, 28 May 2025 03:16:39 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0BCE
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/ba397931-df8a-eea6-d376-7fa91261b534?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-6XpNgidE2p_X902wdDUXNJtxZcPUymIRuEc-~A

43 B
97 B

98ms
96ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-6XpNgidE2p_X902wdDUXNJtxZcPUymIRuEc-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-6XpNgidE2p_X902wdDUXNJtxZcPUymIRuEc-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 0BCE
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDaAFwAT_FX9cwAL

85 B
149 B

221ms
220ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDaAFwAT_FX9cwAL
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748402200.145827,VS0,VE0
age: 596
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/png
x-served-by: cache-mad22058-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 348

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDaAFwAT_FX9cwAL
x-timer: S1748402200.829507,VS0,VE95
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
x-served-by: cache-mad22058-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0BCE
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY

43 B
97 B

95ms
93ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 03:16:38 GMT

POST
H3 204 AGSKWxU6-wtKPRl-9p-LCaii_ctQ5DoyZdJsRGWDlgGB_FiN7FI4p4YkGp4adLZT2JQnVxdB1lT9jEhoyq_YCwDIo4Ij_UOdc2lK1iuGCSClfoiAGKz9_GNgptWph43Irv9lNyAfpIUm2w== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 156ms
155ms XHR
text/html 142.250.81.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU6-wtKPRl-9p-LCaii_ctQ5DoyZdJsRGWDlgGB_FiN7FI4p4YkGp4adLZT2JQnVxdB1lT9jEhoyq_YCwDIo4Ij_UOdc2lK1iuGCSClfoiAGKz9_GNgptWph43Irv9lNyAfpIUm2w==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.81.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rPPfRxJ7sDcmHFsSSHTwMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2IhHo7pDbcOsgkcWN3WzajkkpRfGJ-cn1eSmleim5hSrAtiF2UmlZbkF6GwU8tAKnLy09Mz89LjjQyMTA1Mjcz0DMzjCwwAbcIm7A"
content-security-policy: script-src 'report-sample' 'nonce-rPPfRxJ7sDcmHFsSSHTwMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 115ms
112ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 946a9833aa3b69b8-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:39 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 254ms
121ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 946a9832e95b69b8-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:39 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 784C 0
141 B 245ms
111ms Ping
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 946a98348dd2b7fd-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 03:16:39 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 253ms
117ms Preflight
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 946a9832eb312f4b-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:39 GMT
server: cloudflare
vary: Origin

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame BA30 44 KB
11 KB 134ms
132ms Script
text/html 23.56.163.141
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.56.163.141 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-56-163-141.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: b37f3a1ffd4ea622de54b65156d21527c31bca19160d85f6a5c8d53c42adfc9e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=8653
content-encoding: gzip
expires: Wed, 28 May 2025 05:40:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11387
date: Wed, 28 May 2025 03:16:39 GMT
last-modified: Tue, 27 May 2025 05:40:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://um.simpli.fi/gp_match?google_push=AXcoOmRyV8GsdSlfv5wxTl9fhmWJbLEugGLaTyDbs-RhRQSKVmqTN6Vz96gLBFVLvOAGZrMrlD0962IuSIiinZFXtPIf4ZQ_YXCEJw
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=285FD8F4BEC741E39910CE867643C0AD&google_push=AXcoOmRyV8GsdSlfv5wxTl9fhmWJbLEugGLaTyDbs-RhRQSKVmqTN6Vz96gLBFVLvOAGZrMrlD0962IuSIiinZF...

170 B
188 B

151ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=285FD8F4BEC741E39910CE867643C0AD&google_push=AXcoOmRyV8GsdSlfv5wxTl9fhmWJbLEugGLaTyDbs-RhRQSKVmqTN6Vz96gLBFVLvOAGZrMrlD0962IuSIiinZFXtPIf4ZQ_YXCEJw

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=285FD8F4BEC741E39910CE867643C0AD&google_push=AXcoOmRyV8GsdSlfv5wxTl9fhmWJbLEugGLaTyDbs-RhRQSKVmqTN6Vz96gLBFVLvOAGZrMrlD0962IuSIiinZFXtPIf4ZQ_YXCEJw
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 27 May 2025 03:16:39 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_push=AXcoOmTUVxdoDif-q4LvcOZtER_mgMcG3WcOzaqjIy4GnymMJR8yJ0eAW3WjSbFMQn3VjpGe04iZlyvI1DpyGyEDFwIRkkFw3MCBGg
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTUVxdoDif-q4LvcOZtER_mgMcG3WcOzaqjIy4GnymMJR8yJ0eAW3WjSbFMQn3VjpGe04iZlyvI1DpyGyEDFwIRkkFw3MCBGg

170 B
188 B

152ms
149ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTUVxdoDif-q4LvcOZtER_mgMcG3WcOzaqjIy4GnymMJR8yJ0eAW3WjSbFMQn3VjpGe04iZlyvI1DpyGyEDFwIRkkFw3MCBGg

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AXcoOmTUVxdoDif-q4LvcOZtER_mgMcG3WcOzaqjIy4GnymMJR8yJ0eAW3WjSbFMQn3VjpGe04iZlyvI1DpyGyEDFwIRkkFw3MCBGg
x-msedge-ref: Ref A: A83984377C5A47AFA90D3C714A6351BC Ref B: LAX311000108029 Ref C: 2025-05-28T03:16:39Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAY2KZwJFBTBapBRhEd2Tg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_push=AXcoOmTwhaqhb73ffkBtU7V8xgqC2yCWfpKlSziufnZvof...
https://cm.g.doubleclick.net/pixel?google_hm=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&google_nid=index&google_push=AXcoOmTwhaqhb73ffkBtU7V8xgqC2yCWfpKlSziufnZvofNuIaYfNeEARt-IZ1A97BcFJim_YvIF6c9aebWS-hGZ_S...

170 B
188 B

149ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&google_nid=index&google_push=AXcoOmTwhaqhb73ffkBtU7V8xgqC2yCWfpKlSziufnZvofNuIaYfNeEARt-IZ1A97BcFJim_YvIF6c9aebWS-hGZ_Sz42rBwKrrd2Q

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RcYTGb2hRnevDwCJHZEh6vfZt25%2BL00C53pO5gwXZ7%2F3Ig6RpnlmwMpXie1LMwPqxzkYAjqgxUUBIIW3JQ7pMdqKqZJ%2B5HesGmf7KiNwlj0igUYVqB6SmYhwn3WDZmP18UGTdQ42ItNZOA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?google_hm=aDaAFsAoIngAFq4kAlfb9QAACkcAAAAB&google_nid=index&google_push=AXcoOmTwhaqhb73ffkBtU7V8xgqC2yCWfpKlSziufnZvofNuIaYfNeEARt-IZ1A97BcFJim_YvIF6c9aebWS-hGZ_Sz42rBwKrrd2Q
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a98327bb4f434-LAX
content-length: 0
server: cloudflare

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_push=AXcoOmSXLqwFtWA5nKzy_I7XJHDW-MliaxGWYln3sq-T6gHQI74S42cg_5FaQf3LKjmtbNH1yDI0ub1wxbQE6BPc2BObpudNusXQNA
https://ap.lijit.com/dsp/google/pixelmatch?google_push=AXcoOmSXLqwFtWA5nKzy_I7XJHDW-MliaxGWYln3sq-T6gHQI74S42cg_5FaQf3LKjmtbNH1yDI0ub1wxbQE6BPc2BObpudNusXQNA&sovrn_retry=true
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSXLqwFtWA5nKzy_I7XJHDW-MliaxGWYln3sq-T6gHQI74S42cg_5FaQf3LKjmtbNH1yDI0ub1wxbQE6BPc2BObpudNusXQNA&google_hm=KvAEAGZHNRt-7-sZRFyi...

170 B
188 B

152ms
152ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSXLqwFtWA5nKzy_I7XJHDW-MliaxGWYln3sq-T6gHQI74S42cg_5FaQf3LKjmtbNH1yDI0ub1wxbQE6BPc2BObpudNusXQNA&google_hm=KvAEAGZHNRt-7-sZRFyiUxpy

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmSXLqwFtWA5nKzy_I7XJHDW-MliaxGWYln3sq-T6gHQI74S42cg_5FaQf3LKjmtbNH1yDI0ub1wxbQE6BPc2BObpudNusXQNA&google_hm=KvAEAGZHNRt-7-sZRFyiUxpy
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://ads.yieldmo.com/exptsync?google_push=AXcoOmRUlYq9TnAUXu0g-vMl_wGrUGBYe5YUD7dkIJiTUPJZsuO7cygdgMogKVRK12TP4f9CJIPk2xnKnBX13A6oriHUhTyfpSH-zQ
https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmRUlYq9TnAUXu0g-vMl_wGrUGBYe5YUD7dkIJiTUPJZsuO7cygdgMogKVRK12TP4f9CJIPk2xnKnBX13A6oriHUhTyfpSH-zQ&google_hm=...

170 B
188 B

149ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmRUlYq9TnAUXu0g-vMl_wGrUGBYe5YUD7dkIJiTUPJZsuO7cygdgMogKVRK12TP4f9CJIPk2xnKnBX13A6oriHUhTyfpSH-zQ&google_hm=eElBTjB4eGZVTnhOZEEwWHRjU3A=

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?process_consent=T&google_nid=yieldmo&google_push=AXcoOmRUlYq9TnAUXu0g-vMl_wGrUGBYe5YUD7dkIJiTUPJZsuO7cygdgMogKVRK12TP4f9CJIPk2xnKnBX13A6oriHUhTyfpSH-zQ&google_hm=eElBTjB4eGZVTnhOZEEwWHRjU3A=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_push=AXcoOmQiF2vP3xqTYZctBx7SqVphpjbONmCDIplTiMEw7KhCy8hoRSxP4AmEj6yDAua6vdfw0mAYUBbhJyRFfN1WdqFa4y2IsySFRA
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmQiF2vP3xqTYZctBx7SqVphpjbONmCDIplTiMEw7KhCy8hoRSxP4AmEj6yDAua6vdfw0mAYUBbhJyRFfN1WdqFa4y2IsySFRA&google_hm=OTY4NjI1O...

170 B
188 B

156ms
156ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmQiF2vP3xqTYZctBx7SqVphpjbONmCDIplTiMEw7KhCy8hoRSxP4AmEj6yDAua6vdfw0mAYUBbhJyRFfN1WdqFa4y2IsySFRA&google_hm=OTY4NjI1ODEyMDkyMjEzOTIy

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmQiF2vP3xqTYZctBx7SqVphpjbONmCDIplTiMEw7KhCy8hoRSxP4AmEj6yDAua6vdfw0mAYUBbhJyRFfN1WdqFa4y2IsySFRA&google_hm=OTY4NjI1ODEyMDkyMjEzOTIy
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Wed, 28 May 2025 03:16:39 GMT
Server: Jetty(9.4.51.v20230217)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BC26
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_push=AXcoOmT0NSXSn65M045Wp26mHY6-_9yncNmMhxSMJxx6iZVDYCwEYDvM9Bl60r5TC8f1RgjW9XOAur3Bv4gM_Z87MQZ_Pq48zT3Bp10
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0NSXSn65M045Wp26mHY6-_9yncNmMhxSMJxx6iZVDYCwEYDvM9Bl60r5TC8f1RgjW9XOAur3Bv4gM_Z87MQZ_Pq48zT3Bp10

170 B
188 B

149ms
149ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0NSXSn65M045Wp26mHY6-_9yncNmMhxSMJxx6iZVDYCwEYDvM9Bl60r5TC8f1RgjW9XOAur3Bv4gM_Z87MQZ_Pq48zT3Bp10

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

access-control-max-age: 86400
x-bytefaas-request-id: 202505280316394BE18C1F56FEFE622501
access-control-allow-methods: *
expires: Wed, 28 May 2025 03:16:39 GMT
server-timing: inner; dur=8, cdn-cache; desc=MISS, edge; dur=3, origin; dur=28
x-cache: TCP_MISS from a23-15-6-232.deploy.akamaitechnologies.com (AkamaiGHost/22.1.3-3f9e981ebbcef7152f4c0c8abb8541d4) (-)
date: Wed, 28 May 2025 03:16:39 GMT
x-akamai-request-id: 955f3961
x-tt-trace-host: 0118a3145b56de05206e89162174ff475c5bb0951e72857baa8d816aa8647365c1830e1b7471db2dabb1566f9b714cf8779c2220ec8bc6587300fbe26797bbba60cdf2a3177509c2ac021e19d74c1120a6a62e6608183ed242cbbeda97a9460356
access-control-allow-headers: *
x-bytefaas-execution-duration: 6.67
x-origin-response-time: 28,23.15.6.232
cache-control: max-age=0, no-cache, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0NSXSn65M045Wp26mHY6-_9yncNmMhxSMJxx6iZVDYCwEYDvM9Bl60r5TC8f1RgjW9XOAur3Bv4gM_Z87MQZ_Pq48zT3Bp10
pragma: no-cache
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-credentials: true
access-control-allow-origin: *
x-tt-trace-id: 00-2505280316394BE18C1F56FEFE622501-5EBC335A5CF3B9CE-00
content-length: 0
x-tt-logid: 202505280316394BE18C1F56FEFE622501
server: nginx

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame BC26 0
59 B 151ms
145ms Image
text/html 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LjGRQhmh_hs7J-QS8x0Z8Pz454ZR7HjFkPMMd-947J464dF1EeZNtb0HcXosHTjK8sB2J98_U

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame A7D1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0

43 B
765 B

86ms
85ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiBxO60AjAB&v=APEucNVAQDgIF5Nar8RIAB0aUnbHPQRm-85IzkPj-rQKVc13UlHV5jt4PP4OxgSX4GSJM5Ec8bpv6vDOmuEU4biKAp4-0is2eac3Dltr2_YB4_ywuW9uv-c
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2PFQgd4sRsQIFPGSv1%2FGnimnXWvD3gZLmnqBA0GlpPIY8Pg%2BQTgOMMu3nTsclDKX4QpjZnZI%2BESNFi9nAoz24Gr%2BB8mm0iBSphalP91LqVkQjmxWiKOUs3gwQGethUFKipMRjuubEu64w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a9833d85ff434-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame A7D1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aDaAFsAoIngAFq4kAlfb9QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
763 B

95ms
94ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiBxO60AjAB&v=APEucNVAQDgIF5Nar8RIAB0aUnbHPQRm-85IzkPj-rQKVc13UlHV5jt4PP4OxgSX4GSJM5Ec8bpv6vDOmuEU4biKAp4-0is2eac3Dltr2_YB4_ywuW9uv-c
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=94mOn17Jy5vx%2F0FydumLbKTbLUqBf4PZ4D04V9fOy1ZlMZDFhE51tcv7u2oF6YdPrZzEVHWrhuS6hER%2F2Ci3W3z1OYLI1ukZbN%2BjQpsvd7mXqJKfcUAtDChmR4srCRSqqov3OUG1WMHhJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946a98345a2bf434-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame A7D1 170 B
232 B 150ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiBxO60AjAB&v=APEucNVAQDgIF5Nar8RIAB0aUnbHPQRm-85IzkPj-rQKVc13UlHV5jt4PP4OxgSX4GSJM5Ec8bpv6vDOmuEU4biKAp4-0is2eac3Dltr2_YB4_ywuW9uv-c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A7D1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc3MzU2MTkwOTg1MTE3OTI0Nw%3D%3D&gdpr=0

170 B
188 B

149ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc3MzU2MTkwOTg1MTE3OTI0Nw%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODc3MzU2MTkwOTg1MTE3OTI0Nw%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 5eb17c9c-349b-4e97-9ebc-5b5cca9442cf
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 228ms
227ms XHR
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

35103ccc0e9097cc6fa792325b7a58ac520a0c048946822e73b1907a35ee8665

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: application/json
vary: Origin

GET
H2

200

xuid
eb2.3lift.com/ Frame F00D
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

141ms
139ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Wed, 28 May 2025 03:16:39 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame F00D 170 B
232 B 156ms
154ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F00D
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D

170 B
188 B

149ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame F00D
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

142ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame F00D 0
146 B 264ms
125ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2085371302451904025312&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 41F342A286A54CFB87F26547C1D12FBA Ref B: LAX311000108029 Ref C: 2025-05-28T03:16:39Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAY2KZwJFG/XSG9wcJLDKQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

sync
thrtle.com/ Frame F00D
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=2085371302451904025312
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&vxii_pid=12&vxii_pid1=7006&vxii_rcid=d6376a49-8072-4ae8-8de4-df4343290f3b&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=qjqjgpAhWFVWkYkPD5nQCKL1zvk&_t=1748402200
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A

43 B
538 B

132ms
131ms

Image
image/gif

54.158.211.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 54.158.211.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-211-207.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 03:16:40 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame F00D
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2085371302451904025312?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883

37 B
474 B

143ms
141ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame F00D 42 B
691 B 328ms
100ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2085371302451904025312&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: D3ABA813F78849D282650C49307420B2 Ref B: LAX311000110005 Ref C: 2025-05-28T03:16:39Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame F00D
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=6a1cfac0b56b0688&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN2NZ4nREwJAI_uEGDAQEBAQEBAQCWFeVffAEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

144ms
144ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN2NZ4nREwJAI_uEGDAQEBAQEBAQCWFeVffAEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN2NZ4nREwJAI_uEGDAQEBAQEBAQCWFeVffAEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame F00D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430

37 B
474 B

143ms
141ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Content-Length: 141
Date: Wed, 28 May 2025 03:16:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

203ms
139ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Wed, 28 May 2025 03:16:39 GMT
server: Kestrel

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B0E5 170 B
188 B 299ms
152ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B0E5
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D

170 B
188 B

155ms
150ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D

Requested by

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MjA4NTM3MTMwMjQ1MTkwNDAyNTMxMg%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

139ms
137ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame B0E5 0
146 B 365ms
103ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=2085371302451904025312&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 6A2C2CDC67A14DB8B9F5FC6507C2AD69 Ref B: LAX311000108029 Ref C: 2025-05-28T03:16:39Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAY2KZwLBRF4Pb5hAeB3wA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

sync
thrtle.com/ Frame B0E5
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=2085371302451904025312
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=733e1184-bf85-4cb5-b4d1-35f1aa93bc3a&vxii_pid=12&vxii_pid1=7006&vxii_rcid=cc915a1d-b723-4e70-85c9-f2ec53b7c02c&vxii_rmax=3
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=ef32d9e8-a797-445c-bb5c-82b5e777611f
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A

43 B
537 B

134ms
130ms

Image
image/gif

54.158.211.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 54.158.211.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-158-211-207.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-eSUbsU5E2oQ95Y1NWoGSL4zPepcpuqD8jy.TxQ--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 03:16:41 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/2085371302451904025312?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883

37 B
474 B

144ms
138ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-XxOm9QZE2oRMQIHifGldnxcfg.T7bzhCnzwtSXuNAA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame B0E5 42 B
287 B 424ms
96ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=2085371302451904025312&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: F0CD95F258984F94841072DB39F05F69 Ref B: LAX311000110005 Ref C: 2025-05-28T03:16:39Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=29d74bdc19b505b4&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADLu6-Bk-9WQIC-QOpAQEBAQEBAQCWFeVeAwEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

141ms
141ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADLu6-Bk-9WQIC-QOpAQEBAQEBAQCWFeVeAwEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADLu6-Bk-9WQIC-QOpAQEBAQEBAQCWFeVeAwEBAQEBAQEB&expiration=1748488600&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame B0E5
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430

37 B
474 B

150ms
142ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-aa3aa382-9021-5855-5691-890f0f99d008$ip$162.245.206.249&dongle=4430
Content-Length: 141
Date: Wed, 28 May 2025 03:16:40 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame B0E5 0
887 B 151ms
149ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=2085371302451904025312
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID&ld=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748402199&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zslDDoTkkmy5BHWwE8086%2B9LbejtkssPdkLADuRSz4E%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748402199&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=zslDDoTkkmy5BHWwE8086%2B9LbejtkssPdkLADuRSz4E%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946a9832fb7d2f20-LAX
server: cloudflare

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame AF59
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=

35 B
591 B

143ms
142ms

Document
image/gif

185.167.164.48
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.48 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Wed, 28 May 2025 03:16:39 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 9CBB 43 B
855 B 253ms
136ms Document
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=7C5BB822-426D-4285-B923-C726D5B77ADC&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-223-85-216.compute-1.amazonaws.com

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 28 May 2025 03:16:39 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 9PGK6K5J2C7B2VRSFQTE

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9660
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8773561909851179247&gdpr=0&gdpr_consent=

42 B
218 B

274ms
125ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8773561909851179247&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: c0b86171-f620-4146-8fac-2a8b384f18af
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:39 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8773561909851179247&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame B16A
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFWaXBFN1FiUUFBQUJycXQ4VDJWUQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAVipE7QbQAAABrqt8T2VQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4053601533535749269&gdpr=0&gdpr_consent=

43 B
433 B

133ms
133ms

Document
image/gif

3.223.85.216
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4053601533535749269&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.223.85.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Wed, 28 May 2025 03:16:40 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4053601533535749269&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 0131 0
339 B 394ms
125ms Document
image/gif 38.91.45.7
COGENT-174

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Wed, 28 May 2025 03:16:39 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: b

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 5688
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968062861964269065

42 B
217 B

147ms
125ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968062861964269065
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Wed, 28 May 2025 03:16:39 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968062861964269065
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 1F1E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=

42 B
303 B

201ms
200ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Wed, 28 May 2025 03:16:39 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=qjqjgpAhWFVWkYkPD5nQCKL1zvk&gdpr=0&gdpr_consent=

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 24DF
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
194 B

219ms
219ms

Document
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDaAFwAEwEL7gQAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 596
cache-control: no-cache
content-length: 85
content-type: image/png
date: Wed, 28 May 2025 03:16:40 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 347
x-robots-tag: noindex
x-served-by: cache-mad22058-MAD
x-timer: S1748402200.136948,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDaAFwAEwEL7gQAw
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-mad22058-MAD
x-timer: S1748402200.829291,VS0,VE88

GET pubmatic
ad.mrtnsvr.com/sync/ Frame A0F3 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame C687
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://sync.aralego.com/bsw_sync?ucf_nid=par-E2B44D84BBBDED8A0B297323E4B4A68&dsp_id=445&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=ea0d1df5-6f1f-4c79-87a0-ec3951d79bad&gdpr=0&gdpr_consent=&gdp...
https://x.bidswitch.net/sync?dsp_id=445&user_id=779a25cf-9ffe-3d87-9293-60df65894f4b&ssp=pubmatic&bsw_param=ea0d1df5-6f1f-4c79-87a0-ec3951d79bad
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=ea0d1df5-6f1f-4c79-87a0-ec3951d79bad&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
202 B

126ms
126ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=ea0d1df5-6f1f-4c79-87a0-ec3951d79bad&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=ea0d1df5-6f1f-4c79-87a0-ec3951d79bad&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 4795
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=330314cf-f183-4436-ae20-6e466419b18e&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=7C5BB822-426D-4285-B923-C726D5B77ADC

42 B
495 B

129ms
129ms

Document
image/gif

34.238.45.95
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=7C5BB822-426D-4285-B923-C726D5B77ADC
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.238.45.95 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-238-45-95.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Wed, 28 May 2025 03:16:40 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 28 May 2025 03:16:40 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=7C5BB822-426D-4285-B923-C726D5B77ADC
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 54DB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
95 B

277ms
126ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 946a983468365397-LAX
content-type: text/html
date: Wed, 28 May 2025 03:16:39 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 1042

GET
H/1.1 404
Not Found d0d3910d86e99acbd84ac90b691dc0c5.gif Show response
cs.krushmedia.com/ Frame 9D3D 9 B
519 B 429ms
134ms Document
text/plain 80.77.82.130
NATCOWEB

General

Check archive.org

Download Go to

Full URL: https://cs.krushmedia.com/d0d3910d86e99acbd84ac90b691dc0c5.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&ccpa=[CCPA]&coppa=[COPPA]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 80.77.82.130 , United Kingdom, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/plain
Date: Wed, 28 May 2025 03:16:39 GMT
Expires: 0
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame B382
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=b61ef6530c4e67a5&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU303baf145ee4466bafdf33658003a72a

42 B
540 B

126ms
125ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU303baf145ee4466bafdf33658003a72a
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU303baf145ee4466bafdf33658003a72a
pragma: no-cache
server: Tengine

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame BB21
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=lfeJjZv_i4yOq46Olf-Xj5Srj9iO_42Pm663z33X

42 B
339 B

135ms
135ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=lfeJjZv_i4yOq46Olf-Xj5Srj9iO_42Pm663z33X
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-store, proxy-revalidate
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=lfeJjZv_i4yOq46Olf-Xj5Srj9iO_42Pm663z33X
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7D3A
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
74 B

126ms
125ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 2A35 43 B
347 B 261ms
114ms Document
image/gif 35.186.193.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Wed, 28 May 2025 03:16:39 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
via: 1.1 google

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 4E67 0
181 B 416ms
136ms Document
text/html 138.197.63.78
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 138.197.63.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 88B0
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=7C5BB822-426D-4285-B923-C726D5B77ADC
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=7b386013-8261-4a8f-bdd8-e9afd4ad19a5

42 B
317 B

118ms
116ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=7b386013-8261-4a8f-bdd8-e9afd4ad19a5
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=7b386013-8261-4a8f-bdd8-e9afd4ad19a5
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:38 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H/1.1

200
OK

/
bidberry.net/ Frame 88B0
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=ac7103f98af95e1a88d9e9d0be766f91&gdpr=0
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-ozEWEaVE2pSTWEW1auo2_JJLJ7QofFichA--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&icm&gdpr=0&gdpr_consent=&cver
https://bidberry.net/?partner=1&mapped=869f51fdbe42c273&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/map/c=14544/tp=BIDB/gdpr=0/gdpr_consent=?https%3A%2F%2Fbidberry.net%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D%26redirect%3D
https://bidberry.net/?partner=104&icm&cver&mapped=bb47bde9e7678e57f055ca72ff7016f5&gdpr=0&redirect=

35 B
245 B

212ms
212ms

Image
image/gif

57.129.39.243
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL: https://bidberry.net/?partner=104&icm&cver&mapped=bb47bde9e7678e57f055ca72ff7016f5&gdpr=0&redirect=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 57.129.39.243 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS: ns3235992.ip-57-129-39.eu
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

content-type: image/gif
content-length: 35

Redirect headers

expires: 0
cache-control: no-cache
location: https://bidberry.net/?partner=104&icm&cver&mapped=bb47bde9e7678e57f055ca72ff7016f5&gdpr=0&redirect=
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 0
date: Wed, 28 May 2025 03:16:43 GMT
pragma: no-cache

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame 88B0
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=7C5BB822-426D-4285-B923-C726D5B77ADC&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=7C5BB822-426D-4285-B923-C726D5B77ADC&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=7C5BB822-426D-4285-B923-C726D5B77ADC
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=8773561909851179247&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=8611986256950480670&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
151 B

220ms
218ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDaAGgAAFNy_rQBa
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748402202.432056,VS0,VE1
age: 2144
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 28 May 2025 03:16:42 GMT
content-type: image/png
x-served-by: cache-mad22058-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 1

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDaAGgAAFNy_rQBa
x-timer: S1748402202.038829,VS0,VE172
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 28 May 2025 03:16:42 GMT
x-served-by: cache-mad22058-MAD
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0M1QkI4MjItNDI2RC00Mjg1LUI5MjMtQzcyNkQ1Qjc3QURD&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

382ms
130ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 88B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=fFu4IkJtQoW5I8cm1bd63A%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

113ms
110ms

Image
text/html

184.31.61.14
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 184.31.61.14 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-61-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=102587
content-encoding: gzip
expires: Thu, 29 May 2025 07:46:26 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Wed, 28 May 2025 03:16:39 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

509ms
126ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:85374C435A62442C869EAD0229E2EF30

42 B
513 B

284ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:85374C435A62442C869EAD0229E2EF30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:85374C435A62442C869EAD0229E2EF30
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 27 May 2025 03:16:39 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=

42 B
313 B

388ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=
content-length: 355
date: Wed, 28 May 2025 03:16:39 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=7C5BB822-426D-4285-B923-C726D5B77ADC&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-peCemVNE2uUDcQyoLVwoAKwNCL4sTko-~A&gdpr=0

0
260 B

402ms
124ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-peCemVNE2uUDcQyoLVwoAKwNCL4sTko-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-peCemVNE2uUDcQyoLVwoAKwNCL4sTko-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 03:16:39 GMT
content-type: text/html
server: ATS

GET
H2 200 7C5BB822-426D-4285-B923-C726D5B77ADC
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 88B0 43 B
519 B 142ms
129ms Image
image/gif 2600:1f18:4e9:5a02:c019:9703:677b:fd3b
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/7C5BB822-426D-4285-B923-C726D5B77ADC?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a02:c019:9703:677b:fd3b Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=a6d9b81c-00ad-4064-ae10-e7a3da94901b&gdpr=0&gdpr_consent=

1 B
235 B

133ms
132ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=a6d9b81c-00ad-4064-ae10-e7a3da94901b&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: 9c28e066-2b0e-472c-b5d3-6901a6b29062
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=a6d9b81c-00ad-4064-ae10-e7a3da94901b&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Wed, 28 May 2025 03:16:39 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=371fde33f46011eb&is_secure=true&networkId=17100&version=1&nuid=7C5BB822-426D-4285-B923-C726D5B77ADC&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGUasI5KCsUAIidXCyAQEBAQEBAQCWFeVflAEBAQEBAQEB&expiration=1748488600&nuid=7C5BB822-426D-42...

42 B
369 B

128ms
125ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGUasI5KCsUAIidXCyAQEBAQEBAQCWFeVflAEBAQEBAQEB&expiration=1748488600&nuid=7C5BB822-426D-4285-B923-C726D5B77ADC&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAGUasI5KCsUAIidXCyAQEBAQEBAQCWFeVflAEBAQEBAQEB&expiration=1748488600&nuid=7C5BB822-426D-4285-B923-C726D5B77ADC&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
pragma: no-cache
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 88B0 0
164 B 401ms
128ms Image
text/plain 35.174.227.121
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.227.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-227-121.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 28 May 2025 03:16:39 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=

42 B
309 B

211ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
server: A

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 88B0
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY

1 B
242 B

381ms
128ms

Image
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8611986256950480670&gdpr=0&gdpr_consent=&us_privacy=1NNY
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 03:16:56 GMT

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 88B0
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35391_129014647_16AEA8F603&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

135ms
134ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-431407000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-431407000; includeSubDomains
Cache-Control: no-cache
Date: Wed, 28 May 2025 03:16:40 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:40 GMT
server: nginx

GET
DATA 200
OK truncated
/ Frame 198A 208 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56c3e005c2619d442b6491d5df027652fd2f8aa8c5efa6516734904fc9e7ec2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 198A 0
0 159ms
158ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 198A 0
0 153ms
152ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 198A 0
0 151ms
150ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 504E 38 KB
13 KB 131ms
130ms Document
text/html 2607:f8b0:4006:80d::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 856
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 03:02:23 GMT
expires: Wed, 28 May 2025 03:52:23 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET

UCookieSetPug
image6.pubmatic.com/AdServer/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*0jL5mY-dJv0Wf1AzOYdEYnyTFSdowlAzOYdEYnyTFSceaxZZj1l-CiTiWNwRWz6u&gdpr_consent=undefined&gdpr=false
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&ttl=%%TTL%%
https://ce.lijit.com/merge?pid=27&3pid=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F6%2F3.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/6/3.gif?puid=KvAEAGZHNRt-7-sZRFyiUxpy&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F5%2F4.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/5/4.gif?puid=a6d9b81c-00ad-4064-ae10-e7a3da94901b&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F4%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/4/5.gif?puid=2bb873e4-d10b-4523-a39d-774eb35c292d&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-f6eaXghQY5mQuS92mAbY9PvFiDxvQ4MjzwWcXkT6Ig&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F3%2F6.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-f6eaXghQY5mQuS92mAbY9PvFiDxvQ4MjzwWcXkT6Ig&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F3%2F6.gif%3F...
https://id5-sync.com/cq/483/124/3/6.gif?puid=bad74543-83cc-4969-bc85-3879e0a91128&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F2%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/2/7.gif?puid=u_518aad65-9c2a-4922-9b5a-0aa05e77d346&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F1%2F8.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0

0
0

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 198A 451 B
583 B 338ms
137ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=12268837&cmp=32891887&sid=8602117&plc=417538889&crt=234270386&advid=5925338&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&aucmp=22360937666&auevent=ABAjH0iztQm-2FoRbg2a3kVfeR0u&autt=1&ppid=103&aucrtv=647733761&auorder=1020504884&pltfrm=1&ausite=1995081996404&auxch=1&aufilter1=2765340&c1=2765340&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&brh=2&vavbkt=&lvvn=28&fcifrms=24&winh=600&winw=160&chro=1&noc=16&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7830&uid=1748402199792619&srcurlD=0&ttfrms=54&num=6&dvp_isOnHead=0&flvr=1&ver=7830&jsCallback=__verify_callback_1748402199792619&jsTagObjCallback=__tagObject_callback_1748402199792619&ssl=1&prndr=1&m1=96&blkmode=2&ee_dp_rdystreq=loading&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=67514697.37654188&ee_dp_sukv=67514697.37654188&dvp_tukv=7270728983.223742&ee_dp_tukv=7270728983.223742&dvp_strhd=0.5999984741210938&dvpx_strhd=0.5999984741210938&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTaugad_f2c5agb4b%60256he6b_2baf_22f_e%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&referrer=https%3A%2F%2F82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 509fbdeeb11c2cee977650b13f2b324901a455f01b597561595d52ca451d23d1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 0
Expires: 05/27/2025 03:16:40
Date: Wed, 28 May 2025 03:16:40 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 198A 0
0 299ms
158ms Fetch
image/png 142.250.65.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvpGgEeD01mctfas2YjMFzAF4ck7kyemxUSgsdpEE00PPTxB3SRTSFPyFQPniEYqOZgsdyseSO72EVbPPEsUe6pvkarXCxkfhvll1k7Fq_tfbY7qhvn1CmYSyuoNL82SJ8l9ueKoJUs6nVQ1aGzENSSHysETSmWKjrxvXerSEdHIsQ6t-jZRPnBAP9fL3j8nXHacq589zprqMnw9FxZQVOIu9TJYlnq7B4kQz8UzyQYhB4aAuCB-mmLHoGs62CIbkb8XQWW9G3hahsZHN2YZSXyUm_Zg9AKhYsHFLi9lHhcKj6AiB9lR_Mm6J-E55UQWORjmTnhoSzUjGwAYt0m_pYE1SWyVlcLQw51ns5OxVcmbuYtbDYQ37sF1W3GC72Ze0SKMABbAX2wA5fX6_dU8j946TWkg754cljSZ1VFPVv-AEgSS9ZiaYAjbFEgUse-kX8dg5BAXGKLk-Gzqgp53_tumJFN4aN52VNuGchTDTMkenqedILgikjbI0tnRSuZtY9JEr8GJf3fky13GRmGYsHG1CrSN8H56E5KbjvUxvl3RHCVZg72VfRSiW5-871Bdwi8ruOVMIJJLb3WrqoVeIdM2uYZKRBeIY4psqSgRp0nPsx8d6ke2Xb1Z114uga_lgZoMvMfhfQpJafOEtOYI3bng9KASP-P8-jLdYdhE4C0DiJxBIe5LRdgvU3_IiydCeRRIQcZI8QqNwoszQ4LvrBf5MlsgY413mDvbrxLBqzWodV2krg64z95woZAH7AxBiSIJlUOHGjO6oSqihbU8tGljA9Ux217QwhLSLlZope2VzfDJk6AcUt6rpVlqQYmmR8S1tfv-qWyyoJy7n_D6jJQpPLWOSwTr4E9t3e_nmkwXKnJM8s-BaA5Gza4Jn_n8VjHy_RbBC5NYnRvHLduFc96_IftCAT3GmorgjKcTsAWYNw0tBSkpUG23hvtNCvBc_xbAiuD5l0_9Vqx3bLSqGYAikcH_ZZrNoC7GrU8VYCMCHarRJq4SQlY3QJ-Ffl8URmf6oo6A6w35VDnTjnA-Dh_C3UXLtlVxgkCaw75nLPU4I8H0kJ-R7T2h7uG_ORr8sNDvL6eyxO5S0SUje-BZiJ7KC1glsFc2cvCpKFUG7MHcEeUNDWBB_bNibWRjuUeDivZB4_7-JucDIIlzN7s1bINnQiPAZziUDGlQwXlNcynbDIRVZivzPjKrfJ1ej-EQePJSSk9gKGlbgBbPlAcdprKwDKGzFz4YlvXQWhDObhRM5BJ5EgjjFpExpK8tkU-IRgkfjRV79Yk0-45OQfH0uvF1-Wdyq4uTnxX6ABToaKjwwBn9N2My74zpSD-VDrfW5DxxKqt4qO71niaFhr0m_sEAYyUMPj1_KNZyJM_TybUTMwXncllY1BToJaKj-3j3MuibqH_TTi_WhXIaFMeCYd4rMV-v03AjaYYaInTLWqaNP5Sze8NrM9Wf23xbgem3SztkNM61Q82OUUzRIQCRJR2ZamiDrpkOXCkzP_qmCDsKZaq0aEmrXainFZ__daQyJjP9dcLhHSj9qZC6adNuiFupJzI6o5PNwaYBp2kzz5HdrMnRXaEaSPLhqTWKS7I_KR7sXaD1k6swKK5KjX4SUGTd9i5qHlkcGwI0iMvUZgij8j0sfpnuItddYavbXDdlamK_JMq5jZAbIosBO6svdm7VeWHzuY0gGCqdQgOjqHN0ic14fxQ_XQjU1xDJv35YzhJaECYKTcLwGF79OpJtLEQXOzT_0U1um66Aai9HKUhs3DKYRqEtnvGjhpIYnJgNLMUeQ2RTJsrMI8Vfk_zjFo0wkFVHYUnaxU5YEsh1O6h&sai=AMfl-YRP2x5qxC3TBJjQVP3mw7UEJU484A0ISJ9664_2sxOXO2RHrDAL3U-2b5_mBjDEUhxnParTMDWHVU-0_0YkB0xVWS-qFsCFmwQ_NJzP6_bdLvXqDrtrYIf-CA-FSDZq96xj6ovWlUIP9Pejq2P9S8QEohmMilUbarJwJC0w7clpvvUOeWJRJV3GtO27AetPYq2LIyQabD7pHF1_x2LJxMf6HZiZvFREjvIXs5coqcNPUUlbUFYnQy0kB_OFwM6xE1ma83rk_YmcTFHVJsZ_l8qMLJaReqEg3Vy2mmf9BpwiCz_yTaHfepqRrwbQ_BzDgAyfoq80Rvc4rIYLf8GQYVstHvsIkENT0dhh8pEEy6Uc78BzUY0YYns7cXDTz_2FBqXNZRj9WdDcoUmMiY3TUOlWSwo3qgmomv_4v-EZ&sig=Cg0ArKJSzPRdQ3Y3-GZ1EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=810&cbvp=1&cisv=r20250522.82304&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:16:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x82e80e3cf7eab0c30000000000000000","908705425":"0xc7317e535d211f710000000000000000","908705426":"0x9ea2fa89025a428e0000000000000000"},"debug_key":"8971869899891314871","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054","3582797","3582795","3572756"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"17356071588122785122"}
server: cafe

GET
H3 200 17450261799610016487
s0.2mdn.net/simgad/ Frame 198A 16 KB
16 KB 267ms
130ms Image
image/jpeg 142.251.32.102
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17450261799610016487

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.102 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f6.1e100.net

Software

sffe /

Resource Hash

008b78fc5ec6cec3dd77e8b57615221d6feae2c47aa878b108eafee1f3b092cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

age: 357254
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Sun, 24 May 2026 00:02:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Sat, 24 May 2025 00:02:26 GMT
last-modified: Tue, 29 Apr 2025 17:31:19 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 16515
x-xss-protection: 0
server: sffe

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 818 B
1 KB 228ms
227ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

3ebf72463d321dd03044ed0c4232399bf6e3fe5dac8f461c191261d4b686c922

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: application/json
vary: Origin

GET
DATA 200
OK truncated
/ Frame A0F3 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame A0F3 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 05B8 0
796 B 129ms
128ms Script
text/html 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: c71ee153-dc4b-42e4-b22b-b84841a8516d
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:39 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 819 B
1 KB 274ms
272ms Fetch
application/json 162.19.138.82
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

529e662b7cbdc14409f1711147917bf8d788b70db05f9f54f68c2460f91d17fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: application/json
vary: Origin

GET
H3 200 99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js Show response
pagead2.googlesyndication.com/bg/ Frame 504E 54 KB
20 KB 131ms
130ms Script
text/javascript 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-202-124-0.compute-1.amazonaws.com

Software

sffe /

Resource Hash

f7d95cc67d98bc416e14f07dd01cd82ad75f812b2f494233c19a71236b22a1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 361953
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Sat, 23 May 2026 22:44:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 23 May 2025 22:44:06 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20818
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame BA30 7 B
1 KB 372ms
124ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 91c229169a155ea648dbc4d59ef8a3c5
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 413ms
128ms Image
text/plain 52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 198A 2 KB
1 KB 341ms
136ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=1&ttmms=19&ttfrms=54&brid=96&bridua=3&bds=1&tstype=128&prndr=1&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTaugad_f2c5agb4b%60256he6b_2baf_22f_e%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=70&ddur=601&uid=1748402199792619&jsCallback=dvCallback_1748402199792378&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7830&tgjsver=7830&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2F82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html&fcifrms=24&brh=2&dvp_epl=203&noc=16&nav_pltfrm=Linux%20x86_64&ctx=12268837&cmp=32891887&sid=8602117&plc=417538889&crt=234270386&adsrv=1&advid=5925338&unit=160x600&c1=2765340&bsimpid=08ed99fd56714a5496642ad59468dcdc&prr=1&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0iztQm-2FoRbg2a3kVfeR0u&aucmp=22360937666&aucrtv=647733761&auorder=1020504884&ausite=1995081996404&auxch=1&pltfrm=1&aufilter1=2765340&autt=1&mib=0&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=67514697.37654188&ee_dp_sukv=67514697.37654188&dvp_tukv=7270728983.223742&ee_dp_tukv=7270728983.223742&dvp_strhd=0.5999984741210938&dvpx_strhd=0.5999984741210938&dvp_tuid=1367783922818&jurtd=655738429
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 000964a8cc9e57743ae5613f8d98f34c4ab8b35eb93e5df157966789156253b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 05/27/2025 03:16:40
Date: Wed, 28 May 2025 03:16:40 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 198A 0
20 B 150ms
149ms Ping
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=pvtw&eid=FYA2aOzbPJSY6toPj4C7kAQ&p=doubleverify&bl=0&twt=1185&st=809

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 504E 0
20 B 152ms
149ms Image
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bds5YFYA2aOzbPJSY6toPj4C7kAQAAAAAOAHgBAI&bg=!bm2lbSLNAAYA59AtIOc7ADQBe5WfOLGgQNtZuYD-A5KwJ_ny_neTDgVDxavXwVntAmFgd9N7a8OVtpiax6_u7ZVeg6SSAgAAALxSAAAABmgBB34ANYx8vJnr4wCyjR9GDahvwyKw8-0115mZv40t2H-Acu95j1qKhY4VE0FdYdwClUplgl7unU7JmQKtcphd3X6KToQYrGpYl6qX8Xn2irkKkIAotlHI7Ervy4P25DObQhmBlwJfXnxyF1aDdTJNes9L-rs-_SYK1Dg948M372VLPy7yx8JVY9TnjTLNu8ed04kcrRWKv9IZEUglGm7JvhFsrc0v1AluBcBZJcgHoMG2jNh3iRG6GJIU3Sh-KYWlu-0RhQ-Fh4MZYeTAsZSy88pUZBHL9xNy7C31th3eHcMagtvCvvI4G4DESILtvbcEVi4HEWqGXynmXzJS3d7mdIKfGUl19K0haYfP14fJIHVsxP6bs4tXaHe8hb_2DqSHOg6x07Uh4JqWgtD2DbfnS6TJ1-N8v1f1LNFLSzdSZWmOr5NHMapF3Sc9xojzm-DOuKXjrpiWAZpAchrtluomlRUs4nxDxrTKemb8AXCJCPS0YUIbY-4waTFUT1F6kcmZXElkUWlZyAAlyMKmcsqb_wjWlAVZK4bEOF3zklTTzN0IprdJ81AN6HD5JYWPfv1wzZZg2dPgmBUnuyX8AxCW3UcXSfNIBwfzSWsoAmAQFMb_hjzP8NuHntHVvOySV8M9A0NadMVi-YsILfsKYgUPVX8sR_Ic2SAdeuFBluvT3dZpaVVzg3bnHZnUPgDim04sF3Nk-NGvy0XpO6-ho89-4nqvI1O57uWeNjmNXMQLwN3Q9h7vjWbYcqqOtnRkI9Ju-7mQB8yeokbTUqmyQ9pJaiF1t1kWuKMhKHoX11E_lc5DewQmepWgYHH5DQrPGsqrc77lVdlgy320RwRYqmEbiu4HLbQ9ogG_6JgfuUq5qZki8k6Ew3QkOTPk72ZY0fUcKiLP-KQGtpp5xchKRBmLSIr4Zsgrj8kdUq-Osu16rOLQzJwRItgGFtX6XOQCdJcFr4cD7OzWGjfhYRBd3pkDknMags1tItW6fg

Requested by

Host: 82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com
URL: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1

204
No Content

event.png
tpsc-ue1.doubleverify.com/ Frame 198A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=doubleverify_ddp&google_ula=7327243&google_hm=**&google_redir=https%3A%2F%2Ftpsc-ue1.doubleverify.com%2Fevent.png%3Fimpid%3D63bbac33413346b298b70b1627f...
https://tpsc-ue1.doubleverify.com/event.png?impid=63bbac33413346b298b70b1627f06a1d&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0

0
162 B

271ms
124ms

Ping
text/plain

34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tpsc-ue1.doubleverify.com/event.png?impid=63bbac33413346b298b70b1627f06a1d&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

Expires: 2025-05-27T03:16:40
Cache-Control: max-age=0
Date: Wed, 28 May 2025 03:16:40 GMT
Pragma: no-cache
Connection: keep-alive

Redirect headers

cache-control: no-cache, must-revalidate
location: https://tpsc-ue1.doubleverify.com/event.png?impid=63bbac33413346b298b70b1627f06a1d&flavor=1&gdpr=&gdpr_consent=&dvpx_gfbc=1&tagsrv=1&google_hm=2&google_ula=7327243,0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 390
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 198A 0
0 151ms
150ms Fetch
image/png 142.250.65.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvpGgEeD01mctfas2YjMFzAF4ck7kyemxUSgsdpEE00PPTxB3SRTSFPyFQPniEYqOZgsdyseSO72EVbPPEsUe6pvkarXCxkfhvll1k7Fq_tfbY7qhvn1CmYSyuoNL82SJ8l9ueKoJUs6nVQ1aGzENSSHysETSmWKjrxvXerSEdHIsQ6t-jZRPnBAP9fL3j8nXHacq589zprqMnw9FxZQVOIu9TJYlnq7B4kQz8UzyQYhB4aAuCB-mmLHoGs62CIbkb8XQWW9G3hahsZHN2YZSXyUm_Zg9AKhYsHFLi9lHhcKj6AiB9lR_Mm6J-E55UQWORjmTnhoSzUjGwAYt0m_pYE1SWyVlcLQw51ns5OxVcmbuYtbDYQ37sF1W3GC72Ze0SKMABbAX2wA5fX6_dU8j946TWkg754cljSZ1VFPVv-AEgSS9ZiaYAjbFEgUse-kX8dg5BAXGKLk-Gzqgp53_tumJFN4aN52VNuGchTDTMkenqedILgikjbI0tnRSuZtY9JEr8GJf3fky13GRmGYsHG1CrSN8H56E5KbjvUxvl3RHCVZg72VfRSiW5-871Bdwi8ruOVMIJJLb3WrqoVeIdM2uYZKRBeIY4psqSgRp0nPsx8d6ke2Xb1Z114uga_lgZoMvMfhfQpJafOEtOYI3bng9KASP-P8-jLdYdhE4C0DiJxBIe5LRdgvU3_IiydCeRRIQcZI8QqNwoszQ4LvrBf5MlsgY413mDvbrxLBqzWodV2krg64z95woZAH7AxBiSIJlUOHGjO6oSqihbU8tGljA9Ux217QwhLSLlZope2VzfDJk6AcUt6rpVlqQYmmR8S1tfv-qWyyoJy7n_D6jJQpPLWOSwTr4E9t3e_nmkwXKnJM8s-BaA5Gza4Jn_n8VjHy_RbBC5NYnRvHLduFc96_IftCAT3GmorgjKcTsAWYNw0tBSkpUG23hvtNCvBc_xbAiuD5l0_9Vqx3bLSqGYAikcH_ZZrNoC7GrU8VYCMCHarRJq4SQlY3QJ-Ffl8URmf6oo6A6w35VDnTjnA-Dh_C3UXLtlVxgkCaw75nLPU4I8H0kJ-R7T2h7uG_ORr8sNDvL6eyxO5S0SUje-BZiJ7KC1glsFc2cvCpKFUG7MHcEeUNDWBB_bNibWRjuUeDivZB4_7-JucDIIlzN7s1bINnQiPAZziUDGlQwXlNcynbDIRVZivzPjKrfJ1ej-EQePJSSk9gKGlbgBbPlAcdprKwDKGzFz4YlvXQWhDObhRM5BJ5EgjjFpExpK8tkU-IRgkfjRV79Yk0-45OQfH0uvF1-Wdyq4uTnxX6ABToaKjwwBn9N2My74zpSD-VDrfW5DxxKqt4qO71niaFhr0m_sEAYyUMPj1_KNZyJM_TybUTMwXncllY1BToJaKj-3j3MuibqH_TTi_WhXIaFMeCYd4rMV-v03AjaYYaInTLWqaNP5Sze8NrM9Wf23xbgem3SztkNM61Q82OUUzRIQCRJR2ZamiDrpkOXCkzP_qmCDsKZaq0aEmrXainFZ__daQyJjP9dcLhHSj9qZC6adNuiFupJzI6o5PNwaYBp2kzz5HdrMnRXaEaSPLhqTWKS7I_KR7sXaD1k6swKK5KjX4SUGTd9i5qHlkcGwI0iMvUZgij8j0sfpnuItddYavbXDdlamK_JMq5jZAbIosBO6svdm7VeWHzuY0gGCqdQgOjqHN0ic14fxQ_XQjU1xDJv35YzhJaECYKTcLwGF79OpJtLEQXOzT_0U1um66Aai9HKUhs3DKYRqEtnvGjhpIYnJgNLMUeQ2RTJsrMI8Vfk_zjFo0wkFVHYUnaxU5YEsh1O6h&sai=AMfl-YRP2x5qxC3TBJjQVP3mw7UEJU484A0ISJ9664_2sxOXO2RHrDAL3U-2b5_mBjDEUhxnParTMDWHVU-0_0YkB0xVWS-qFsCFmwQ_NJzP6_bdLvXqDrtrYIf-CA-FSDZq96xj6ovWlUIP9Pejq2P9S8QEohmMilUbarJwJC0w7clpvvUOeWJRJV3GtO27AetPYq2LIyQabD7pHF1_x2LJxMf6HZiZvFREjvIXs5coqcNPUUlbUFYnQy0kB_OFwM6xE1ma83rk_YmcTFHVJsZ_l8qMLJaReqEg3Vy2mmf9BpwiCz_yTaHfepqRrwbQ_BzDgAyfoq80Rvc4rIYLf8GQYVstHvsIkENT0dhh8pEEy6Uc78BzUY0YYns7cXDTz_2FBqXNZRj9WdDcoUmMiY3TUOlWSwo3qgmomv_4v-EZ&sig=Cg0ArKJSzPRdQ3Y3-GZ1EAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1528&vt=11&dtpt=718&dett=3&cstd=1528&cisv=r20250522.82304&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Wed, 28 May 2025 03:16:40 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x82e80e3cf7eab0c30000000000000000","908705425":"0xc7317e535d211f710000000000000000","908705426":"0x9ea2fa89025a428e0000000000000000"},"debug_key":"12689221983990875260","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054","3582797","3582795","3572756"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"74272959684455339"}
server: cafe

GET
H3 200 PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html Show response
s0.2mdn.net/sadbundle/16109550510171750400/ Frame 9270 6 KB
2 KB 131ms
130ms Document
text/html 142.251.32.102
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16109550510171750400/PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.102 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s77-in-f6.1e100.net

Software

sffe /

Resource Hash

2245cf0ddc4e0b7988f5771eda1e34b2912d8c60c54d9a4e9eae603defcf141e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://82507a4d283c31ade96e30a3270aa706.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 313193
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1893
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 24 May 2025 12:16:47 GMT
expires: Sun, 24 May 2026 12:16:47 GMT
last-modified: Tue, 29 Apr 2025 17:31:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame B4D8 953 B
1 KB 93ms
92ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 417fd4a19fd034f1cfe1edee87e1b8cc68e693c1adc96c612e983c80d1ff2695

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 953
content-type: text/html
date: Wed, 28 May 2025 03:16:40 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.249

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BA30
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/eEn41O309fkMyuYw67-ZBcn5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UgRCnytE2oLNvBv6R3_L3iCoAqLm8On49S7SJg--~A

42 B
1 KB

291ms
123ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UgRCnytE2oLNvBv6R3_L3iCoAqLm8On49S7SJg--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-UgRCnytE2oLNvBv6R3_L3iCoAqLm8On49S7SJg--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BA30
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

379ms
131ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=e45b56ce-6106-45c8-ac11-b9b4b8e38eb1&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Wed, 28 May 2025 03:16:40 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BA30
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDgxNDNlZTA5Y2ZmZGIzNTZjOTczNDdkMGVjZjNkNTdjMjI5YWUyOA&us_privacy=1NNY

170 B
188 B

148ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDgxNDNlZTA5Y2ZmZGIzNTZjOTczNDdkMGVjZjNkNTdjMjI5YWUyOA&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NDgxNDNlZTA5Y2ZmZGIzNTZjOTczNDdkMGVjZjNkNTdjMjI5YWUyOA&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 91c229169a155ea648dbc4d59ef8a3c5
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame BA30 43 B
855 B 137ms
134ms Image
image/gif 98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 9M0C3SE4K5Z75Y8Z6ESV
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 03:16:40 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame BA30 170 B
188 B 152ms
148ms Image
image/png 142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BA30
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI3RElYREEtMUYtSEw0Vw==&us_privacy=1NNY

170 B
188 B

148ms
148ms

Image
image/png

142.251.40.226
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI3RElYREEtMUYtSEw0Vw==&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.226 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 03:16:41 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI3RElYREEtMUYtSEw0Vw==&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame BA30 43 B
855 B 706ms
284ms Image
image/gif 54.239.33.159
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.239.33.159 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 8T66TSAXS76NNP0GRAT0
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 03:16:41 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=MB7DIXDA-1F-HL4W&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

134ms
134ms

Image
image/gif

98.82.157.137
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MB7DIXDA-1F-HL4W&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.157.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PB1Y02E92K629TB3WTDS
Content-Length: 43
Date: Wed, 28 May 2025 03:16:41 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MB7DIXDA-1F-HL4W&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
px.ads.linkedin.com/ Frame BA30
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB7DIXDA-1F-HL4W&us_privacy=1NNY

0
145 B

114ms
114ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB7DIXDA-1F-HL4W&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lor1-x
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-msedge-ref: Ref A: 4A5ED153AC80419E810DF7E72B01435A Ref B: LAX311000108029 Ref C: 2025-05-28T03:16:41Z
x-li-fabric: prod-lor1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: AAY2KZweaPnmo6T+wghbLg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB7DIXDA-1F-HL4W&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 0

GET
H2

200

usersync
vid-io-iad.springserve.com/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/token?pid=52948&gdpr=1&gdpr_consent=&us_privacy=&rk=iad&us_privacy=1NNY
https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB7DIXDA-1F-HL4W&gdpr=1

43 B
206 B

392ms
129ms

Image
image/gif

52.70.236.82
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB7DIXDA-1F-HL4W&gdpr=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.70.236.82 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-70-236-82.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-origin: *
content-length: 43
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif
server: nginx
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB7DIXDA-1F-HL4W&gdpr=1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BA30
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAVipE7QbQAAABrqt8T2VQ&expires=30

42 B
1 KB

367ms
123ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAVipE7QbQAAABrqt8T2VQ&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 91c229169a155ea648dbc4d59ef8a3c5
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAVipE7QbQAAABrqt8T2VQ&expires=30
Content-Length: 0
Date: Wed, 28 May 2025 03:16:40 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

pixel
capi.connatix.com/us/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1NNY
https://capi.connatix.com/us/pixel?puid=MB7DIXDA-1F-HL4W&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY

0
329 B

179ms
83ms

Image
text/plain

172.64.146.152
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MB7DIXDA-1F-HL4W&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 172.64.146.152 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 946a983d7e1f7c04-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Wed, 28 May 2025 03:16:41 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MB7DIXDA-1F-HL4W&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 0
Content-Type: text/html

GET
H2

200

ProfilesEngineServlet
syncv4.intentiq.com/profiles_engine/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=primis&us_privacy=1NNY
https://live.primis.tech/live/liveCS.php?source=external&advId=100&advUuid=MB7DIXDA-1F-HL4W&us_privacy=1NNY
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MB7DIXDA-1F-HL4W
https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MB7DIXDA-1F-HL4W&ckls=true&ci=MuStPMmnnT&nc=false&trid=1885448010

43 B
1 KB

448ms
143ms

Image
image/gif

3.168.122.31
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MB7DIXDA-1F-HL4W&ckls=true&ci=MuStPMmnnT&nc=false&trid=1885448010
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.168.122.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-122-31.jfk52.r.cloudfront.net
Software: /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 a75abffd2aaa3fabfaa23d0bc3b0e77a.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:42 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: 6agk4tLG9LX5n78f2YYfRTXMo1EIJiDG5mNHZlDJz6iOCe7gc894Nw==

Redirect headers

patent: https://www.almondnet.com/ip
cache-control: no-cache, no-store, must-revalidate
location: https://syncv4.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=793790479&3rddpi=1725065545&3rdpcid=MB7DIXDA-1F-HL4W&ckls=true&ci=MuStPMmnnT&nc=false&trid=1885448010
pragma: no-cache
via: 1.1 7f0be4bd5f44e2c53326699ef91b86b4.cloudfront.net (CloudFront)
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif
x-amz-cf-pop: JFK52-P7
x-amz-cf-id: vMBkxfe-pYYGWG3egKgVtwGMWBSLmyt06gmsM6GXMUfHkXpJOuuxxQ==

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx&us_privacy=1NNY
https://sync.a-mo.net/setuid/magnite?uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY

0
725 B

469ms
125ms

Image
text/plain

125.253.89.185
SS-ASH

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 125.253.89.185 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Wed, 28 May 2025 03:16:40 GMT
x-envoy-upstream-service-time: 2
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame BA30
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn&us_privacy=1NNY
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY

43 B
1 KB

129ms
127ms

Image
image/gif

68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 6119ffe1-e9c7-41bd-856b-fc63ae9ba0ac
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:41 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB7DIXDA-1F-HL4W&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BA30
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=a6d9b81c-00ad-4064-ae10-e7a3da94901b&expires=30&us_privacy=1NNY

42 B
1 KB

122ms
122ms

Image
image/gif

69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=a6d9b81c-00ad-4064-ae10-e7a3da94901b&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: c8d9fb0c-c9b3-42b9-a8b0-ed79eadb86a7
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=a6d9b81c-00ad-4064-ae10-e7a3da94901b&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Wed, 28 May 2025 03:16:41 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame B4D8 0
1000 B 160ms
159ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=172090ba-f6b9-4f06-892d-a9496c6dbaf0
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748402200&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=YRc7YTV%2F6x51KQuCf7TjJVx8V7hbnNE%2BhYzhbBDsHLM%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 03:16:40 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748402200&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=YRc7YTV%2F6x51KQuCf7TjJVx8V7hbnNE%2BhYzhbBDsHLM%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946a983a7a1a2f20-LAX
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B4D8
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=8773561909851179247

43 B
61 B

93ms
93ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=8773561909851179247
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=8773561909851179247
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.249; 162.245.206.249; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8b45b8db-6860-4f9a-95bc-eb50ee7d54f5
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame B4D8
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=7b386013-8261-4a8f-bdd8-e9afd4ad19a5
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

115ms
114ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 03:16:41 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame B4D8 95 B
767 B 301ms
161ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=28806c89-1421-4168-a840-f18adebab971

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B4D8
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=

43 B
61 B

94ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=1388c68d-6999-41c7-9cb0-36ac1fa69e2b-68368017-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 28 May 2025 03:16:40 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame B4D8
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=a6d9b81c-00ad-4064-ae10-e7a3da94901b

43 B
61 B

93ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=a6d9b81c-00ad-4064-ae10-e7a3da94901b
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:39 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: b13a2929-40d0-4970-b99d-041079539d0d
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=a6d9b81c-00ad-4064-ae10-e7a3da94901b
Content-Length: 112
Date: Wed, 28 May 2025 03:16:40 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame B4D8
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=8aiVSeagxcEE1SXrPi9Cxw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

96ms
94ms

Image
image/gif

35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.249
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 03:16:40 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Wed, 28 May 2025 03:16:40 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 68110cc2c8c9e5ee932db79a Show response
c.bannerflow.net/a/ Frame 9270 56 KB
20 KB 244ms
93ms Script
application/javascript 2606:4700::6811:6147
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://c.bannerflow.net/a/68110cc2c8c9e5ee932db79a?did=5ced17d285b1c200019c3fe1&&redirecturl=https%3A%2F%2Fad.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuB0_9S1E-R94jqJ9PXocxYacENpIgIl9Mt3XQMuBCZzBLm8w5WR37-_MZip5IbPD4_8UcAIIDaKF9nB6Ii9ppvR86FLaHhJhFNM5KzN_vfbVCPLCJ2iC8-MoVINdiYrwrTBVgD69EJN3I-j1Ch-ta-PILhSsTlkPOwcX7ceOfcDX7Og_DPk0U9kdMh-j8x7EZV3HoYIHpTpMlfi9DicuavRuGoev-IxIy8umOzjg7RLtnpXJUAavjVh6dZfS2Gd1x07XgDTWa-Itjo2lSYpV_2P_dPXV6AF-ZIK8cakdmfyIWlMp6W5kdbSX-CCx7T58opymSzwOfz2DZEWyrKNmR9rhrzve6mCyWVbuAIT9LWRO8chDxFV5hEsBGSLAHCh32MSdaPDF4i0YWDBD7LUxEJC2MwJZfHVd2mzaXC76JZJI1s0-W1gFqaXqvFKZ2SJN0cCiLa0p4lVLebjW3XIw08RD9QmzXDgUy8JNN6pnPoM6kUB_tmDdRb_Ntz6CvExsGJFmImzSvuRp8j3Np-XjRaI6SAWU1_hZSNM7b1PXdO21rDWGB4Ah368YbNNyOegUX9yJGPfVpB5I_jpbzO-6Md-3oWfkFwJPptHPfjYxqNipNsdHPPQOif0iJSHaN4J73FUx4TK8kNvJSi71zjCttoih42hPNqlBzLKQSSveirnIzmVMieJmbPg2iZi-OxYLPj2uDSzChlQ6bXO5PujPnmVSygEy1zsjJZ2C4TksoMrBsbtM1jOStaoGFNKo-xY3JWWp3GKzX-VefwmshlGSatr2rsUydeDNTG1eUh2JhlRTGc3TRDcZv6QrAkWn7SnOgETqQvhBQzFfHBMLrSCgg_YS98J8oeAdWfW3opMwQ5c7TzlV_GlbYbjBGTFE704pHIsJupwV-SYKEa8acAwqnVeBPqPbNbRjJz0h0gT2EhgUElyqYGL-AEkkxwJ44pVmi0vksAOPxydAJuULLsQsrYavvIu0TqH4TO9cVal6ax8qAjPZWjjzW_spa2LKk9QlyHylukm6l1w1ZmWxom_31K4FmegQduDdvtx0QIc04N5S3ZmhSVLxPA01pY814V4Clh0sJgWYpvWF2_djGezkonqTlwpvz88bKl6FDrMfPsvygvUiRnjQ_o9_8CpHyvJXXYN8OQdp3THG1hGmk-iOb1t-SBSixilAQEYBHIbabG198_MEWv2BdjS1I4xGnyX1VL7DSKuuv5CTncdOzch6Tj6jLIM0Oc3kH1rjhOsRKn96A-g6S99u9yEBQtmBLdsUlgFoidVx21WvkSFISxYoHfslgQ1SvjDJleITZxBTtNM7s8PC27nuMENzcgwVO4lDtMuSAl7kRuvMQ4LYbk_4HpA0gh67lSBq3zyKBG_he7MEvfh6tNSXJDW_5POgQrFeu2DDRSN3kCZtRZJIvztz5q4MtwZtNeccVOmWBR2siURSJMDNAx1CqsbW3lC-IQElzkV5Nf1aM1KsGPapfTvPaJ33HrBi71bFooWtnJQg5PYRvA75AuPFsOSZLXGlGm0atb0PYM-lf-77ub4L2SDh-TXVAut2uNR4no0IcQljPrdGx09pYM5J638HwDgwd5V4Y9JgvLoHF5Kt-itT-GrBXqSHHzqpaHGPzz6u5wswJ5gO1kbKL2SPDSjKgMc8kMxoXV1yooDem-9KlmELvJzb7DomeRNYmAtMatnRRy5CUW76EA8tqx2woalw1fBqa1aqiW5yzSjIp2OhMRe6P3b70Ng3LA4g2m7gGz3KPVYFVxCdGZ2J3rKWhZ4WcJyEMQ2g3bTmTkVm2wpbxcDhOvrsmWNvOb9llyZzRJbYw29m8FdJhLH-bKra1g61UuFfVaEXuGIDo7dqHZh6KR9w%26sai%3DAMfl-YTaRgA1RGhZ_qdHXNDKGw4M2d4Xqv650zv830lw6NE5l2WUO5p0DLmtb04iPhDNewfZbl1m97JmQ0-Do0GTQiPIexbw3HkH3wwc13CI0ZZp3gc1k5Vu4FpBIhqYabNaHDvDuRMhEXOagHXDB1AibMMHLVhS_WKDNrRcerXQO0b3ILPSezK1qWW2-clCCbESXhXAFYe-3FjURBBpBpbn8U6E5iQ_VG91g9CtXrdLzXg1nFGrRKFOHqG9A4xt98uSaqI6TpozBaCKa1HbZJmZ6Go0MUA%26sig%3DCg0ArKJSzIYu9GeAtuKBEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26crd%3DaHR0cHM6Ly9wYW5kb3JhLm5ldA%26urlfix%3D1%26rm_eid%3D%255Brm_exit_id%255D%26adurl%3Dhttps%253A%252F%252Fus.pandora.net%252Fen%252Fcollections%252Fpandora-essence%252F%253Fcid%253Ddisp%253Adv360%253A%253Aessence%253Amidfunnel%253Ano_promo%253A%253A%253A%253A%253A%253A%253Amixed%253A%253A%253A%253Abelove_summer%2526dclid%253D%2525edclid!%2526gad_source%253D7
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16109550510171750400/PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html?ev=01_253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6147 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1244bef37383f1d6e0998e4f681329fa7936ce308a60b309080d0e379e24948

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

cache-control: public, s-maxage=10, max-age=10
content-encoding: br
cf-cache-status: HIT
age: 7
cf-ray: 946a983bbcc90fb2-LAX
date: Wed, 28 May 2025 03:16:40 GMT
content-type: application/javascript
last-modified: Wed, 28 May 2025 03:16:30 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 198A 42 B
65 B 215ms
214ms Fetch
image/gif 142.251.32.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu3ItjmpARDm55Btt1fO5VeZ_oQnYmWS8K67IN8P4EtJG6rhcddOFAj22OOvai5la3l_l3udQ39AI3EDPO52wGl6fzFVhbqdjFuG7TSN8t9X9EYEQvia-JsHSQ0DdtIUHxI7adLRiZlCzSh8GaM5ImassZpoWuw7gawqx5YZEpsE3S7QtuUE33ZpHYvlafDaiPPff0rmGkc&sai=AMfl-YTAqB_Fayd38Ets3unqxBSx8kf9yXR4IU7I57BYA75uC9JMDhdOrnWylFbCVlZT-aHADIyFHdtDFiVkui9ROy9_ppHEst5mPSIceKZKKu4ZVEBv2jl0UpE2R7UB&sig=Cg0ArKJSzE5_AZLYmWnnEAE&cid=CAQSPADZpuyzq89c57fKkNiMTLkTyTLYFPRmaCBUjPWxL9QXwPoLEzggUCr81NHyBMBe4EmtBFBGQH4aQYrQ4RgB&id=lidar2&mcvt=1001&p=313,139,353,180&tm=1151.3000030517578&tu=150.10000228881836&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20250521&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4433499900&rst=1748402198921&rpt=772&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.32.98 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS