paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 4212
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1664
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 06:53:43 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JWATP5J7BWBYA0Z0DC45P8RR

Redirect headers

accept-ranges: bytes
age: 4214
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 06:53:43 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JWATP5FV839RCXCBSB55ZJZY

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 326ms
180ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d57aeef7e1cc78f91bfd101fb71fab851a19caf8dc5d79dba52870f04bcbf7a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 946bd62b7d738406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 92ms
91ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 7926
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JWATP5MWTSVAWQTAKJ3PQBS3
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 76ms
75ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 4212
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JWATP5MWKMN3DJM2FEQYJ565
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 76ms
76ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 16993
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JWATP5MWJ31006Q6T1TC43CK
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 142ms
142ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 2829
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JWATP5MWK5EW44DVNCBTGMD8
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 77ms
75ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 2829
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JWATP5SF3PJQWR9C00TF6ZQJ
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 86ms
85ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 19386
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JWATP5SF36KA6RPCX0KGGG1K
cache-status: "Netlify Edge"; hit
date: Wed, 28 May 2025 06:53:43 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 93ms
92ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb3f5aea4dfe39f39b0e24121650cf1933c527b48ccd623dfb123077b7e81884

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 946bd62b7d768406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
125 KB 459ms
160ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

08d47a5abbab4141ceca4da523e59864c589aef00ae743f3149a287734236c21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 06:53:43 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 127646
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 l2kqas_4gasjf.main.js Show response
faucetfoot.com/assets/js/ 68 KB
25 KB 295ms
106ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/assets/js/l2kqas_4gasjf.main.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

5f2e5f4bcb21a21859982774adfb57489c0125a455880f70c2b5f858330fd470

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-pddz.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 109 KB
34 KB 426ms
158ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aadaffefb60cedd91515e0a3832d5f87d547896e6db4ca44faccd067f231beda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 420 / 20236 / m202505200101 / config-hash: 17886797544696259832
x-content-type-options: nosniff
expires: Wed, 28 May 2025 06:53:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34419
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 589 KB
180 KB 93ms
87ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8110ded3886a93d34096358d663e7c487101a735b4720a076ed8ba4af6f00f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"369edfdc43d190015e70ab72de8421b6"
age: 2615
cf-ray: 946bd62cae258406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 18:09:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 411 B
363 B 84ms
78ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4432306bea5bc5e3eb215684c33d5d61af819593a1d5c7b309e4828fa3d5f60

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a16c35147bcd6c17a711b7e5cecd32a1"
age: 2631
cf-ray: 946bd62cbe268406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:22 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 21 B
414 B 188ms
90ms Script
application/javascript 104.18.24.242
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.24.242 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c39da8dc0f2f6bea346a3a104bd7a476a287ef14feb787e952290855193d781e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 946bd62d4fdddec3-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 21
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.d2b17692f73365eb3b1b.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
2 KB 160ms
159ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db6470e8c88ce44b00b55b0299fc7908a2a65d97c97821ec15cf52d53e9d3bc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"98de13c923d1e4bdb88ad3c624400fa1"
age: 2631
cf-ray: 946bd62d3e678406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:24 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.9a246b8b1f07b7fdf439.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 521 KB
158 KB 208ms
207ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 439802ea4c65ce3139bb013e0f569258a15fb5a45e65e3e558fd45bdfdce0a2e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"44906344077043e1967ca3ce3b56dcab"
age: 2631
cf-ray: 946bd62d3e698406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:43 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:20 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
481 B 383ms
126ms Image
image/gif 2600:9000:247b:4600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=aqglya_728x90_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:4600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 97928
x-cache: Hit from cloudfront
x-amz-cf-id: viKSBlp1ohXBCSVkMcawAREp9sFfA0aHpJ0xEfYYwFPjLMBtkcmrFg==
date: Tue, 27 May 2025 03:41:36 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 dd0e76eb9b3ff90ab87e33f1490318e8.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 559 B
464 B 91ms
90ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 2631
cf-ray: 946bd630c84d8406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:28 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame FC08 503 B
428 B 339ms
100ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1296dcaec9839fa03c7635bdff3028ae2659a5ce02c2a69e1b1f26271873387c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 2632
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 946bd63249aa97ca-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 06:53:44 GMT
hw-country-code: US
last-modified: Tue, 27 May 2025 15:56:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame FC06 503 B
0 336ms
336ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1296dcaec9839fa03c7635bdff3028ae2659a5ce02c2a69e1b1f26271873387c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 2632
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 946bd63249aa97ca-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 06:53:44 GMT
hw-country-code: US
last-modified: Tue, 27 May 2025 15:56:18 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/2/desktop/Chrome/ 586 B
921 B 416ms
132ms XHR
application/json 2600:9000:24f1:9a00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/2/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:9a00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 8f47b0b6d12e05ee9ab8da43a096de5484cfda70baf97739637b151a72a315f1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 2839
via: 1.1 bd3fb8ca205d8e5f716067cdf581fa76.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 586
x-amz-cf-id: sQn3GQLh6rw1nY9sG7s808K6gnrgsgkXcExMCyrlaLJg6HmdHhYsSA==
date: Wed, 28 May 2025 06:06:25 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 147 KB
39 KB 236ms
93ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ede294970ef91011fa116caddc304b79b12da961364a7efc1d36be2ef0b2ed19

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "79676e47c9590aa6aaaba9fc5252337f"
via: 1.1 google
cf-ray: 946bd631d8e97b5d-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39465
date: Wed, 28 May 2025 06:53:44 GMT
content-type: application/javascript
last-modified: Wed, 28 May 2025 06:41:46 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
2 KB 78ms
75ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 2632
cf-ray: 946bd630e8588406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:17 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 567ms
269ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2e59f047b948e0064dcaae021a60684c7179b6e242a55e39687f66ca56bae864

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"116928b14c634baeae938e7fe2fcd163"
age: 3325
via: 1.1 157ebd6865840045fc8b5ed1cce7e466.cloudfront.net (CloudFront), 1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 6ONoyE6WH9_2JubDtIGro9Dr5qqbUByKDEu86WEr41oX7eePOL5rAg==
date: Wed, 28 May 2025 05:58:20 GMT
content-type: application/javascript
last-modified: Wed, 21 May 2025 18:19:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
587 B 3765ms
1656ms Image
image/gif 2606:50c0:8003::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: feef5c087fa932fe76e52fe058a5430336fb100c
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 1000:11D1A7:2291322:258F774:6835F8FD
expires: Wed, 28 May 2025 06:58:46 GMT
x-cache: HIT
date: Wed, 28 May 2025 06:53:46 GMT
content-type: image/gif
x-served-by: cache-toj-leto2350037-TOJ
x-cache-hits: 15
source-age: 205
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1748415227.655942,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 129ms
129ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 81697
x-content-type-options: nosniff
expires: Wed, 27 May 2026 08:12:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 27 May 2025 08:12:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
111 KB 166ms
164ms Script
application/javascript 2607:f8b0:4006:80f::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55q0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80f::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6038d914bd60903ad501db9b3199c6c49d266ce8f73e8ecf9171235b09f07152

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 06:53:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:44 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 113603
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 475ms
143ms Fetch
text/plain 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55q0v9101576445za200&_p=1748415223429&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&cid=1873605099.1748415225&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748415224&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsadv.posambient.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1847
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 462ms
144ms Script
text/javascript 108.138.128.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-34.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 44018
via: 1.1 77c1752e5c6dfb050c6304b9d473a1e2.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: HMA4fItu1TWd8tFI6qabI3nfludC_t4jZXE2b0xAhyNRtyMw3C1qow==
date: Tue, 27 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/ 63 KB
23 KB 148ms
147ms Other
text/plain 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9b502c40cea58eb57328f78cf48c787ab82d46606203a135bbb813ee19fb6c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8651680878418282224
age: 57142
x-content-type-options: nosniff
expires: Tue, 03 Jun 2025 15:01:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Tue, 27 May 2025 15:01:22 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23432
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505270101"

POST
H3 200 p1iy8pdmmzwk6348taxqspy_8g Show response
faucetfoot.com/ 295 B
319 B 194ms
111ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/p1iy8pdmmzwk6348taxqspy_8g

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/assets/js/l2kqas_4gasjf.main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

ad183f078833c81d6cf1aa868753b744fae465823e9d43642fbaa077c72f5b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-pddz.gce-us-west1, 1.1 google
expires: Wed, 28 May 2025 06:53:43 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Wed, 28 May 2025 06:53:44 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame FC08 17 KB
7 KB 87ms
86ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 2632
cf-ray: 946bd6330b4e97ca-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:19 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250527.5/iframe/ Frame FC06 17 KB
0 79ms
79ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250527.5/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 2632
cf-ray: 946bd6330b4e97ca-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:44 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:19 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 143ms
142ms Fetch
text/plain 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55q0v9102396898za200zb9101576445&_p=1748415223429&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130495~103130497~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&cid=1873605099.1748415225&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748415225&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsadv.posambient.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1748415223429&tfd=2413
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55q0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 203 KB
66 KB 477ms
179ms Script
application/javascript 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8324c84903f5dd3f953009ee3deeafcc5dc72e95975c458a56a408e4003839e1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-1Hv6mBrbmnZL0EhHNwHA_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw15BiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgbh3yS3WqUC8a-Mt1sNA3KR9m7ULiM38brPaAbEQD8fPp7cOsgkc6P81h0lJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyEzPwDi-wAAAYfdEng"
content-security-policy: script-src 'report-sample' 'nonce-1Hv6mBrbmnZL0EhHNwHA_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 392ms
130ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 49924
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: pxXNfLvT4lW4kDI_hhOqOIez0_cbpIvPGsUblkCrRFVOXvKNKzy9xg==
date: Tue, 27 May 2025 17:01:42 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 ed8dbde89917eaa6ca93ba7fad809c48.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
826 B 415ms
141ms Script
application/javascript 108.138.106.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-59.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 224
via: 1.1 bce50d2cc476ede482a8048a0c124908.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 2Vce4Yrio2--1FbxiE5HUuNmogdlK3uq7YsT-lRx3blGwNJ2eLJ2jA==
date: Wed, 28 May 2025 06:50:01 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 130ms
130ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 20918
access-control-allow-credentials: true
via: 1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: 2yXCu4zd0b_V9A8hz63k3bX1eO_CPQzXSS0oxkG0WXQcnv2sFo3i3A==
date: Wed, 28 May 2025 01:05:06 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
234 B 281ms
120ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
630 B 220ms
76ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 323500
x-goog-stored-content-encoding: identity
expires: Sat, 24 May 2025 13:15:04 GMT
x-goog-stored-content-length: 43
date: Wed, 28 May 2025 06:53:45 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwqtvh56VQsUgcmWAi6drHIX4zUCLnIdhHCfrjmn5Im1gC2CkZRJCaSDhn4MMG9uArr567qUFEI
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 946bd6372c8308d5-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 683ms
136ms Image
image/x-icon 142.250.65.230
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 48501
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Wed, 28 May 2025 17:25:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 27 May 2025 17:25:24 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 224ms
81ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.47303500628567086
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 323500
x-goog-stored-content-encoding: identity
expires: Sat, 24 May 2025 13:15:04 GMT
x-goog-stored-content-length: 43
date: Wed, 28 May 2025 06:53:45 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AAO2Vwqtvh56VQsUgcmWAi6drHIX4zUCLnIdhHCfrjmn5Im1gC2CkZRJCaSDhn4MMG9uArr567qUFEI
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
cf-ray: 946bd6372c8508d5-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET 3b8fffea-fe97-4111-a413-1dedf0d26492
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 379ms
129ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 06:53:44 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 176923
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 161ms
87ms XHR
application/json 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 8464
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Wed, 28 May 2025 04:32:41 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 946bd636dbd708e8-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250527.5/ 3 KB
1 KB 79ms
77ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250527.5/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/runtime.d2b17692f73365eb3b1b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 2632
cf-ray: 946bd6366bd78406-LAX
alt-svc: h3=":443"; ma=86400
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 15:56:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 568ms
275ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 601bfcf1b27fabb6a392417eb5e9ecc37fe05935703235ba7284fc178ce9edc6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 449 KB
142 KB 468ms
179ms Script
text/javascript 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2408f96d0ae09f62f95d73bcc6f521f5e7cd2b62f46a57ae450a36a386632fae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 4408055776961230618
x-content-type-options: nosniff
expires: Wed, 28 May 2025 06:53:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145165
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 1293ms
209ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-225-240-34.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
779 B 590ms
299ms Fetch
application/json 54.221.197.184
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.221.197.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-221-197-184.compute-1.amazonaws.com
Software: /
Resource Hash: 807c8ac5821409d2fea49347355b0b9cd5a163af168d4e851b60fa24d7aadf29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
686 B 729ms
447ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: c4b9c6f4f10026e0ee73ee9bbd0a1bd86a3d2be2d567091b332e6b1dee255b82

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 263ms
100ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 93e3945c567f3a79d09a2db1f03b273b388bc795fb133067ee86c73b6aa80424

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 28 May 2025 06:53:43 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
541 B 411ms
150ms Fetch
text/plain 54.225.240.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.225.240.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

b66c2bb4094dbceb9759df5e9335119a4cf334983eb825c30b5800d2f308bb0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 76eb74b6a3747017
request-time: 9
access-control-allow-credentials: true
expires: Thu, 29 May 2025 06:53:45 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=oX9WmXx5UDZFVGl1TmZ3SlUyNDUvM0NKcTNHR2dJSzVwb3MvaCs4QmZwM2RnbXdGZmZtOTgwU05BcG9mV2RFOTVuZCt6V3lwbjlBMW1hTWd2Q0JjQ0V3cnNENU1YUU9DRGlKUmVya2VYYXRwV0F2b2ZWUDBDc2hXOXlZNW...

365 B
927 B

548ms
297ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=oX9WmXx5UDZFVGl1TmZ3SlUyNDUvM0NKcTNHR2dJSzVwb3MvaCs4QmZwM2RnbXdGZmZtOTgwU05BcG9mV2RFOTVuZCt6V3lwbjlBMW1hTWd2Q0JjQ0V3cnNENU1YUU9DRGlKUmVya2VYYXRwV0F2b2ZWUDBDc2hXOXlZNWc3NWxmR1hQNSthbFR2T1B0dEhTOWNsZlk3NVNPcjVWcGVheFlsNms5MlhlSVFoaFR6NHFKUUhTRFZXRmR4dGpNejJkMFdtb2c0VjVkZi9wbWhjblRaK09PWWhramdNT1ZqYko4dVU1eDFreUJmdmJib2MvamVNaUhVcDJVL3VzZHN5MnVMSmRmfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

0e8dc1d8fc7021b1400b5270ace61ffef70573238c8b3174aa388b19a577b469

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 503301
expires: 0
access-control-allow-origin: null
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=oX9WmXx5UDZFVGl1TmZ3SlUyNDUvM0NKcTNHR2dJSzVwb3MvaCs4QmZwM2RnbXdGZmZtOTgwU05BcG9mV2RFOTVuZCt6V3lwbjlBMW1hTWd2Q0JjQ0V3cnNENU1YUU9DRGlKUmVya2VYYXRwV0F2b2ZWUDBDc2hXOXlZNWc3NWxmR1hQNSthbFR2T1B0dEhTOWNsZlk3NVNPcjVWcGVheFlsNms5MlhlSVFoaFR6NHFKUUhTRFZXRmR4dGpNejJkMFdtb2c0VjVkZi9wbWhjblRaK09PWWhramdNT1ZqYko4dVU1eDFreUJmdmJib2MvamVNaUhVcDJVL3VzZHN5MnVMSmRmfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 222078
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 06:53:45 GMT
server: Kestrel

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
377 B 573ms
293ms Fetch
application/json 108.139.52.211
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqsadv.posambient.com%2F&pid=ybyQZHn41Dy03&cb=0&ws=1600x1200&v=25.520.1758&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=1e1cafaf-6dc3-4f14-89c7-37187d05772e&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.52.211 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-52-211.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 3d84bfab616d594edc9340870455ee6a.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: bi-ZwSpvK8y74IpboLYkWuMzrKakuY6lywYTQnnyoObdcUCXuEhfXA==
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P1
server: Server

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 695ms
130ms Script
application/javascript 184.28.162.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.28.162.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-28-162-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Wed, 28 May 2025 07:08:46 GMT
accept-ranges: bytes
content-length: 17407
date: Wed, 28 May 2025 06:53:46 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 291ms
287ms Script
text/javascript 108.138.128.34
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-34.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 80247
via: 1.1 77c1752e5c6dfb050c6304b9d473a1e2.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BvmG0FyTA3WyBv125Cqc3U46m1P6qPqzOLSkDe7cGUYdVHgbeYoeIg==
date: Tue, 27 May 2025 08:36:19 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 247ms
84ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.posambient.com%2F&_it=amazon&partner_id=403
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3084
cf-ray: 946bd638096a530d-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Mon, 02 Jun 2025 06:53:45 GMT
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 305ms
161ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: n2QssjeE/KY1Z1SNPFbaBMyDgXYmj5p7AYxx8iPgGmeDoXfUNBX3wNH5db5TSS/cYxzytnAJnHS7YVhEJV4yW+aXAUXMcxQg74M064waMsQ=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 3019
x-amz-request-id: SZVSDZ0WJW3CWTA3
cf-ray: 946bd6389f2d08f6-LAX
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 711ms
261ms Script
application/javascript 184.28.162.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.28.162.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-28-162-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Wed, 28 May 2025 07:08:46 GMT
accept-ranges: bytes
content-length: 5252
date: Wed, 28 May 2025 06:53:46 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfZmExOTdlODItMjI2Yi00YmU5LWFiYjMtZWNjNGE0Zjc3MDkyXzE3NDg0MTUyMjUyNzQQABoNCPnl2sEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=fb09e4dae1db859cc3bb6357022d0dc408bc4d69fcd7e75a6f97287d3a6c0c4e791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=fb09e4dae1db859cc3bb6357022d0dc408bc4d69fcd7e75a6f97287d3a6c0c4e791426b5417dce21&rand=01569038
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=fb09e4dae1db859cc3bb6357022d0dc408bc4d69fcd7e75a6f97287d3a6c0c4e791426b5417dce21&rand=01569038&expected_cookie=5fc93d4a-4679-4090-8d5e-d56c8e4bac32

0
143 B

173ms
173ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=fb09e4dae1db859cc3bb6357022d0dc408bc4d69fcd7e75a6f97287d3a6c0c4e791426b5417dce21&rand=01569038&expected_cookie=5fc93d4a-4679-4090-8d5e-d56c8e4bac32
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 91B8E7A3DC65436AA93DA31B25ADC623 Ref B: LAX311000112035 Ref C: 2025-05-28T06:53:46Z
x-li-fabric: prod-lva1
x-li-uuid: AAY2LKSDIYscef6aoR71tA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 06:53:46 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=fb09e4dae1db859cc3bb6357022d0dc408bc4d69fcd7e75a6f97287d3a6c0c4e791426b5417dce21&rand=01569038&expected_cookie=5fc93d4a-4679-4090-8d5e-d56c8e4bac32
x-msedge-ref: Ref A: 7B70E5A511CE4EA0B71D5F920DD4D422 Ref B: LAX311000112035 Ref C: 2025-05-28T06:53:46Z
x-li-fabric: prod-lva1
x-li-uuid: AAY2LKSA5k+iRoXdrrQojQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 06:53:46 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274

1 KB
2 KB

135ms
135ms

Script
application/javascript

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: bd3503bf88271ac38d11ab51bd85a98787b186fc62263422c78e70a90021497c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:46 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:46 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
447 B 633ms
338ms XHR
application/json 34.193.179.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.179.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-179-5.compute-1.amazonaws.com
Software: /
Resource Hash: 9f767d8423f76ee4215769322550b98987ca69642c140e90500619c9393e1fc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 9889 2 KB
1 KB 398ms
128ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=135656
content-encoding: gzip
content-length: 859
content-type: text/html
date: Wed, 28 May 2025 06:53:45 GMT
expires: Thu, 29 May 2025 20:34:41 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 7520 1 KB
2 KB 236ms
69ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 776
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:40:49 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: ABgVH89mlVRl2DICmln6IlYKv4jDGnw2MDlbiC1KnWkJb9Nv_CxhAAKZaV2yhSfYCr3Kb01j6s-7Ww

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 245ms
155ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0da8b2e3a831ebd1fda95197942bdca28ff38171bd8a70f49dbf5617dd8fe79e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415225&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1oHP%2BV2uKY0dWV9GH21WGyIaVGSidvpm99XKmA87Afk%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415225&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1oHP%2BV2uKY0dWV9GH21WGyIaVGSidvpm99XKmA87Afk%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 946bd637f88e7cf8-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 40 KB
15 KB 763ms
685ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ab852bbbb91c9b06a79ba067594f551922457edb0919e1c577d556054c5d870

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415225&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1oHP%2BV2uKY0dWV9GH21WGyIaVGSidvpm99XKmA87Afk%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415225&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=1oHP%2BV2uKY0dWV9GH21WGyIaVGSidvpm99XKmA87Afk%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 946bd637f8907cf8-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
278 B 1138ms
212ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:46 GMT
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
626 B 623ms
142ms Fetch
application/json 3.168.102.47
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-47.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 2f145a00060d4d07e668011e7bd4a796e6c34400ea225fc6934565c3af9e1e35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 d6e8d455c6249e06c531b544b92279c0.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: ljuIIQ5vvGT-XWfXFyurfSH2_ptVV8eN4p8GSAwoZnMMeoD1bX4DyQ==
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 400 auction Show response
elb.the-ozone-project.com/openrtb2/ 236 B
707 B 320ms
173ms Fetch
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6589f704aea9fcfe5d5fb76ec2827b5aeaa1b91d8e541f0c35a2b3de58a57983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 946bd6388d212b96-LAX
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 236
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 711ms
143ms Fetch
application/json 3.208.175.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.43.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.208.175.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-208-175-5.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ect,sec-ch-save-data,sec-ch-viewport-height,sec-ch-width,user-agent,sec-ch-dpr,sec-ch-ua-platform,sec-ch-prefers-color-scheme,sec-ch-ua-full-version-list,sec-ch-downlink,sec-ch-viewport-width,sec-ch-ua-mobile,sec-ch-rtt,sec-ch-ua-arch,sec-ch-ua-full-version,sec-ch-ua,sec-ch-ua-bitness,sec-ch-device-memory
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
362 B 291ms
104ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 66d1bd9e3eb8a80523e3fc20f9ba7bcf6b911ed1f212f2cf7322d525c12e52b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.244
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain
vary: Origin

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 702 B
1 KB 1561ms
330ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=441fc171-5987-48b1-879b-6d8db98a3a23%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f784b7c-f027-493a-9ae3-520dc5f6316a%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.posambient.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.43.0&x_source.tid=b8dc6c64-4e4f-47cf-9570-ed53e5fbdaa8&l_pb_bid_id=881a74e5e7d1f668&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=0eebafd5-7640-47f2-b86d-d12affcb334b&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.4568016229998332
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 8cc74305b1749f0ec0d66a550510e8cca374bde16c8959d7f1ad093bac7266c4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 534 B
894 B 1558ms
330ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=441fc171-5987-48b1-879b-6d8db98a3a23%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f784b7c-f027-493a-9ae3-520dc5f6316a%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.posambient.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=b8dc6c64-4e4f-47cf-9570-ed53e5fbdaa8&l_pb_bid_id=89b95a6bae851a28&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=e13e7627-9b21-4d30-99db-dc928214985d&p_site.mobile=0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.8486253983222981
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 95fbf64d84c8eb59b6ea633a67884cd9ec2e75e2caea474194dc09722bb6ec22

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 534
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 540 B
902 B 1558ms
331ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=441fc171-5987-48b1-879b-6d8db98a3a23%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f784b7c-f027-493a-9ae3-520dc5f6316a%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.posambient.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=b8dc6c64-4e4f-47cf-9570-ed53e5fbdaa8&l_pb_bid_id=90fd8618bd518e98&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=34603386-27c7-48dc-9bc1-bd9ac777e771&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.20317549714747685
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 7145876022d4459f6c53376d351e5faf3293a02ba8edd601d4ffdda374c19dde

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 540
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 540 B
900 B 1556ms
329ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=441fc171-5987-48b1-879b-6d8db98a3a23%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=6f784b7c-f027-493a-9ae3-520dc5f6316a%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.posambient.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=b8dc6c64-4e4f-47cf-9570-ed53e5fbdaa8&l_pb_bid_id=91104008a938b3d&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=2b098c55-596a-4b48-bf90-e5b44b8c9d34&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.06827175443865319
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 9f9d3d60876ffcedcc122597f356b7db6e49b153efa5e4d2010d0e11f64bb2a6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 540
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
690 B 800ms
471ms Fetch 146.190.198.231
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.198.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 06:53:46 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
949 B 656ms
329ms Fetch 146.190.198.231
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.198.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 06:53:46 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
686 B 892ms
565ms Fetch 146.190.198.231
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.198.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 06:53:46 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
693 B 749ms
423ms Fetch 146.190.198.231
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.198.231 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Wed, 28 May 2025 06:53:46 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 1142ms
123ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.43.0&cb=9914174493&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:45 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
673 B 173ms
91ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a67474b9003c65499189cdff70634eb6ca3fc4f5afbf84a9e7cd03f2c41f31da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXppmtb4%2FDHe6dj21OvVtJSm5xp7A4UEqw7nwxEDn%2FhYj35t7PcGVOGzkHl3VDO4su189ifEExabeV0%2Fy%2B%2Br5wY8fR78yrzodNscxP0SDxRpKV6LvWfbsFmenO7ApHPv6D3gFzZW"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 946bd6383b5349d4-LAX
access-control-allow-origin: https://paint.toys
content-length: 37
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 414ms
206ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748415225522&to=600&aun=pw-160x600_atf&pubcid=441fc171-5987-48b1-879b-6d8db98a3a23&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=0eebafd5-7640-47f2-b86d-d12affcb334b&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9370&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 412ms
204ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748415225523&to=600&aun=pw-160x600_btf&pubcid=441fc171-5987-48b1-879b-6d8db98a3a23&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=e13e7627-9b21-4d30-99db-dc928214985d&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9370&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
244 B 411ms
204ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748415225523&to=600&aun=leaderboard_atf&pubcid=441fc171-5987-48b1-879b-6d8db98a3a23&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=34603386-27c7-48dc-9bc1-bd9ac777e771&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9370&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 414ms
207ms Fetch
application/json 54.190.245.136
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748415225523&to=600&aun=leaderboard_btf&pubcid=441fc171-5987-48b1-879b-6d8db98a3a23&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=2b098c55-596a-4b48-bf90-e5b44b8c9d34&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9370&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F136.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.190.245.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-190-245-136.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 418ms
136ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 751ms
474ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6c29ec1aa9e5d3f183a2521ed5291b85f0e0107a588b8198b56c9bf4ad8fea8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
583 B 424ms
136ms Fetch
application/json 68.67.181.211
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.211 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: f3fbf263-a88f-419c-bd82-45aed799698c
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:45 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 613 B
704 B 471ms
188ms Fetch
application/json 54.242.219.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.242.219.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

1ee65b77551396060e786e7a9147a7a22cf66467fb1deae22c6110d3e20eeee4

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 348
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 773 B
820 B 603ms
320ms Fetch
application/json 54.242.219.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.242.219.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

cca2965cd96e06b69252547df567cf0ae549f55b853402e6a474960d71f9c734

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 464
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 421ms
138ms Fetch 54.242.219.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.242.219.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 540ms
257ms Fetch 54.242.219.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.242.219.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
487 B 335ms
333ms XHR
application/json 34.193.179.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.179.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-179-5.compute-1.amazonaws.com
Software: /
Resource Hash: d92e664b663b48005b5575d93dabba3e617ce842e38fdc1f4c470fa3a73d8629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Wed, 28 May 2025 06:53:45 GMT
content-type: application/json;charset=utf-8

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame 07C8 0
101 B 932ms
180ms Document
text/plain 44.235.139.86
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.235.139.86 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-235-139-86.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Wed, 28 May 2025 06:53:46 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 247ms
86ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.posambient.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 6930
cross-origin-resource-policy: cross-origin
cf-ray: 946bd63b0bc17d77-LAX
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 28 May 2025 02:58:47 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
264 B 547ms
546ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.posambient.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 28e9cb839cc6cac40a074a262bd0ff26d61e8cd29c45bc50113e7cbbf5bcfc89

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 946bd63b2cc0f7cf-LAX
access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 248ms
90ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 946bd63a8b38f7cf-LAX
content-length: 0
content-type: text/plain
date: Wed, 28 May 2025 06:53:46 GMT
expires: Thu, 28 May 2026 06:53:46 GMT
server: cloudflare

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1748415225853&did=did-0046&se=e30&duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.posa...
https://rp4.liadm.com/j?dtstmp=1748415225853&did=did-0046&se=e30&duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.pos...

13 B
371 B

399ms
128ms

Fetch
application/json

54.175.179.23
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1748415225853&did=did-0046&se=e30&duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.posambient.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 54.175.179.23 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-175-179-23.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 5f553cf5-0cff-47e4-85a4-903ab8a68858
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1748415225853&did=did-0046&se=e30&duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.posambient.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo1
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Wed, 28 May 2025 06:53:46 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
97 B 1727ms
865ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 414ms
127ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 411ms
128ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 country Show response
api.btloader.com/ 37 B
216 B 300ms
112ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 289ms
112ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=MlJ9WZuGM-J9gfp07tV-9715ab1dc6&sid=lAKr9VzNp-0RjKHyTMV-9715ab1dc6&cv=2.1.102-1-g48599ff&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:46 GMT
vary: Origin

GET
H2 200 AGSKWxUWScFusjU3X4pNvVXz5BlXCiIy6qj_E360MfcpJf8XM6ylIi82XQTsxh53U1e6eiUfNguPx46R27Y1kK0jbXzPImL8tpezashQiwv-CBZYQyylt83-rxuhHkdhKkegaZxgZECnww== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 165ms
164ms Script
application/javascript 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUWScFusjU3X4pNvVXz5BlXCiIy6qj_E360MfcpJf8XM6ylIi82XQTsxh53U1e6eiUfNguPx46R27Y1kK0jbXzPImL8tpezashQiwv-CBZYQyylt83-rxuhHkdhKkegaZxgZECnww==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDE1MjI2LDYwMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsImdQUkQwTkZlcTVJIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsInFzYWR2LnBvc2FtYmllbnQuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d5042fab936107f067180df1cc5224d9d5c35217f7a565c3c63ba3f24b7e215e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-fyG37jkdhvWKEc2AXbpgpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw0JBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjXxlush4G4Sfs2axcQm_ndZrUDYiFujl9Pbx1kE7ixarGnkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkamBqZGZnoFxfIEBAKoHP-4"
content-security-policy: script-src 'report-sample' 'nonce-fyG37jkdhvWKEc2AXbpgpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame AD66 102 KB
28 KB 404ms
129ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2871
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:05:55 GMT
expires: Wed, 28 May 2025 06:55:55 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 3006ms
1354ms Script
application/javascript 2600:9000:24f1:2800:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:2800:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 3491
x-cache: Hit from cloudfront
x-amz-cf-id: DyMIsnYYTf2i_F56LQ7bke58EijohvpMOJtA6z-jDUOkb6d1vzjziQ==
date: Wed, 28 May 2025 05:55:37 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 cd958e502c6aea704f0f824e60431e72.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 248ms
67ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 35409
x-goog-stored-content-encoding: gzip
expires: Wed, 27 May 2026 21:03:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 27 May 2025 21:03:37 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: ABgVH88PbEhc4KNqtq7ttq1VkVdwKKf_1aitr_XckGqx8XMrZByumb4ka0fQAIrn39jPBUA
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 402ms
229ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: 95c0324c7a4647eab317fedeefbb6a3e

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 479ms
74ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 151880
cf-ray: 946bd63e1b85f7dd-LAX
expires: Sat, 31 May 2025 06:53:46 GMT
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 1088ms
516ms Script
text/javascript 74.119.117.47
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.47 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Thu, 29 May 2025 06:53:46 GMT
access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 375ms
120ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 06:53:46 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 198894
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 AGSKWxV3kmrFaQaazL7hm8wULUNOXLbiup5I2wnj_35NiMKqmPUu8XHayK2aOA30wwWqNUtlmbGcss--hsGePNO4-3TNfFKNFj7zYYJGH7dCyEtKATr64LjEGklDjsG8Xkxy_5rMmcb0Fg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 186ms
185ms Script
application/javascript 2607:f8b0:4006:81e::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV3kmrFaQaazL7hm8wULUNOXLbiup5I2wnj_35NiMKqmPUu8XHayK2aOA30wwWqNUtlmbGcss--hsGePNO4-3TNfFKNFj7zYYJGH7dCyEtKATr64LjEGklDjsG8Xkxy_5rMmcb0Fg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDE1MjI2LDIzNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiZ1BSRDBORmVxNUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXNhZHYucG9zYW1iaWVudC5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3687771f2ef80913aa512e6db6d4afc53b4e8aca44e6e43f9e84a4760ac8bb25

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-KHcbdY3z9pFSs2r2VmWb3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw0pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjXxlush4G4Sfs2axcQm_ndZrUDYiEejl9Pbx1kE3jQs2Yho5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRmZ6BcXyBAQDqAkA9"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-KHcbdY3z9pFSs2r2VmWb3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 132ms
131ms Script
application/javascript 184.28.162.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.28.162.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-28-162-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Wed, 28 May 2025 07:08:46 GMT
accept-ranges: bytes
content-length: 17042
date: Wed, 28 May 2025 06:53:46 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
12 KB 87ms
85ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?partner_id=403&sync=1&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 3044
cf-ray: 946bd63c9d74530d-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Mon, 02 Jun 2025 06:53:46 GMT
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 216ms
80ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10c0d08c9ddb0dece1c1a2499d1b9a6913d43283165ccbcfcbe0911273000af3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 10710
cf-ray: 946bd63d7d837c33-LAX
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Tue, 27 May 2025 23:55:28 GMT

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
246 B 320ms
104ms Image
text/html 44.231.152.158
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.231.152.158 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-44-231-152-158.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&adnxs_id=$UID&gdpr=0
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fmatch%3Fid%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C%26adnxs_id%3D%24UID%26gdpr%3D0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&adnxs_id=4589633088515201920&gdpr=0

43 B
95 B

595ms
594ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&adnxs_id=4589633088515201920&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd6439aff2b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&adnxs_id=4589633088515201920&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 9ecede94-f35e-46ef-b7b3-bfe1b06ff52f
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=758cf428-be23-4002-9af2-1fa059718fd1&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&auid=AU1D-0100-001748415226-MTQ6VZOD-4X7C

43 B
95 B

120ms
119ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=758cf428-be23-4002-9af2-1fa059718fd1&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&auid=AU1D-0100-001748415226-MTQ6VZOD-4X7C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd642796b2b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=758cf428-be23-4002-9af2-1fa059718fd1&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&auid=AU1D-0100-001748415226-MTQ6VZOD-4X7C
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:46 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C
https://ids.ad.gt/api/v1/pbm_match?pbm=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C

43 B
171 B

274ms
116ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd64249332b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:46 GMT
server: nginx

GET
H/1.1 204
No Content token
token.rubiconproject.com/ 0
1 KB 1428ms
240ms Image
text/plain 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001748415226-MTQ6VZOD-4X7C&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Pragma: no-cache

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748415226-MTQ6VZOD-4X7C&gdpr=0
https://match.adsrvr.org/track/cmb/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748415226-MTQ6VZOD-4X7C&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=9444d490-22d8-4620-ba75-e14530a48ee8&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C

43 B
94 B

191ms
119ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=9444d490-22d8-4620-ba75-e14530a48ee8&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd64249372b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=9444d490-22d8-4620-ba75-e14530a48ee8&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
content-length: 259
date: Wed, 28 May 2025 06:53:47 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748415226...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=ae739019-b8b5-45f5-8095-876a82646c7f%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=9444d490-22d8-4620-ba75-e14530a48ee8&ttd_puid=ae739019-b8b5-45f5-8095-876a82646c7f%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&tapad_id=ae739019-b8b5-45f5-8095-876a82646c7f

43 B
119 B

357ms
357ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&tapad_id=ae739019-b8b5-45f5-8095-876a82646c7f
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd649c9cb2b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&tapad_id=ae739019-b8b5-45f5-8095-876a82646c7f
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Wed, 28 May 2025 06:53:48 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
410 B 428ms
146ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001748415226-MTQ6VZOD-4X7C
https://ids.ad.gt/api/v1/amo_match?turn_id=4222015451435415569&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C

43 B
119 B

128ms
126ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=4222015451435415569&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd64d1d012b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=4222015451435415569&id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 06:53:48 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&uid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0

43 B
96 B

282ms
281ms

Image
image/gif

2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&uid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd6459d642b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&uid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 28 May 2025 06:53:47 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-175
x-xss-protection: 0

GET
H2

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQxNTIyNi1NVFE2VlpPRC00WDdD

170 B
233 B

154ms
154ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQxNTIyNi1NVFE2VlpPRC00WDdD

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 946bd642f9f42b7c-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQxNTIyNi1NVFE2VlpPRC00WDdD
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=9444d490-22d8-4620-ba75-e14530a48ee8&bid=1e2n4ou

70 B
440 B

493ms
493ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=9444d490-22d8-4620-ba75-e14530a48ee8&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:47 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=9444d490-22d8-4620-ba75-e14530a48ee8&bid=1e2n4ou
content-length: 191
date: Wed, 28 May 2025 06:53:47 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MmdPWVczUUpjREdRa2c2b1k1S3liUUNqelg3X3NueFBkc1RQMlQteW1iZE0&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MmdPWVczUUpjREdRa2c2b1k1S3liUUNqelg3X3NueFBkc1RQMlQteW1iZE0&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

417ms
143ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:47 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Ed_6yrxE2pXPGo3DaRbvp.zaVL.1u1RTqT0-~A&gdpr=0

70 B
440 B

134ms
133ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Ed_6yrxE2pXPGo3DaRbvp.zaVL.1u1RTqT0-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:48 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-Ed_6yrxE2pXPGo3DaRbvp.zaVL.1u1RTqT0-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8870183159921614382&newuser=1&referrer_pid=m51mh00

70 B
440 B

155ms
153ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8870183159921614382&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:49 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=8870183159921614382&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 06:53:55 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=4777514603718852505&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

128ms
128ms

Image
image/gif

34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=4777514603718852505&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:46 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=4777514603718852505&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ea4745e3-8980-4b7a-8eef-0efe620016fe
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:46 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 417ms
134ms XHR
application/json 2606:ae80:1451:18::1780
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:18::1780 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Wed, 28 May 2025 07:23:46 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2 200 bounce Show response
id5-sync.com/ 29 B
447 B 220ms
218ms Fetch
text/plain 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

aca701811d62eb608d12b174231be1ceae3449fe0f4bc847469ff22aab8ca9a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:46 GMT
content-type: text/plain;charset=utf-8
vary: Origin

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 655ms
222ms Fetch
application/json 2001:41d0:701:1000::2209
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::2209 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 54537e44ef395b827684d6c0378e9d508b799234f77e6eb026c7fe5e33becf20

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 663ms
225ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
531 B 403ms
247ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b96ceb0932b1aa53d0dfb7813ea1b478f1a5243f3fcba0381e4c17d855328718

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
x-cloud-trace-context: 4ad1e600b3020646cd3db213a6529058
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
114 KB 156ms
156ms Script
application/javascript 142.251.40.104
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.104 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

52707e1d735482ec8f4df9467d489fb7640b0e1dc9830a3c4972961ed85be412

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Wed, 28 May 2025 06:53:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 116556
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 182ms
180ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 946bd63e1ea77d77-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:46 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
89 B 279ms
134ms Script
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd6441acd090d-LAX
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 700 B
250 B 120ms
119ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9c9f44ae5e76826622ee187c5d3b5cb70579cbe94187800678bc20d6f6ccf99

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 946bd63fcf802b54-LAX
access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:46 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 268ms
125ms Preflight 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 946bd63efebc2b54-LAX
date: Wed, 28 May 2025 06:53:46 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
95 B 170ms
169ms Image
image/gif 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001748415226-MTQ6VZOD-4X7C&halo_id=060ixeeju6a659b66666666666666666666uommwi0e0y6g000000000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 946bd6433a682b7c-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 722ms
216ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 024B
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

943 B
1 KB

110ms
109ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 5f98f29013446457aa1682a200b0a0979e2644dfaf7cd8ca6a76f239a9635b1a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 943
content-type: text/html
date: Wed, 28 May 2025 06:53:46 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Wed, 28 May 2025 06:53:46 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 141ms
140ms Script
application/javascript 184.28.162.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.28.162.13 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-28-162-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Wed, 28 May 2025 07:08:46 GMT
accept-ranges: bytes
content-length: 67550
date: Wed, 28 May 2025 06:53:46 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 4AAF 5 KB
2 KB 240ms
92ms Document
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1096
apigw-requestid: LQrediOVPHcESMg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 946bd6417b302b55-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 06:53:47 GMT
last-modified: Wed, 28 May 2025 04:09:00 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H3 200 ad_footer._your_ad. Show response
fundingchoicesmessages.google.com/f/AGSKWxW30UBcpqvJgC77o92dYsupehFvIiBLbuACJpUSOtkA6zUTNH7g5c79tsBwkFRN2v7jSl9se2TyKC7EDNh4EaZ_CS8wUEliV9DIkc94YdFqb41nAtds9qxQUHcksQ7Q40IIQJ4vNyEdlbizKxlJlBChfP2ss... 54 B
109 B 161ms
160ms Script
application/javascript 142.251.40.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxW30UBcpqvJgC77o92dYsupehFvIiBLbuACJpUSOtkA6zUTNH7g5c79tsBwkFRN2v7jSl9se2TyKC7EDNh4EaZ_CS8wUEliV9DIkc94YdFqb41nAtds9qxQUHcksQ7Q40IIQJ4vNyEdlbizKxlJlBChfP2ssrDaEM-2Zu2BVOOLKKX1-2rwnzUMOyBy/_/adloader./adgenerator./adsframe./ad_footer._your_ad.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b8b5b6dbaf6b14174eaff44e5a191df40b223d5e2e725ee6ee88b363bf3a7ec7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-_1Cl72bVq6qug7FT_KR_kQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw1pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjNxlusW4G4Sfs2axcQm_ndZrUDYiFujt9Pbx1kE9jR_t5OSSMpvzA-OT-vpCgzqbQkvygtOS21OLWoLLUo3sjAyNTA1MhMz8A4vsAAAKfIP9w"
content-security-policy: script-src 'report-sample' 'nonce-_1Cl72bVq6qug7FT_KR_kQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 68 KB
25 KB 425ms
139ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0b6be733a75c06fed01535cc89204b6f73599ec410a73586c43f2fc7870c54fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5285642847050520510
age: 2366
x-content-type-options: nosniff
expires: Wed, 28 May 2025 07:14:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 06:14:21 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 25568
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxU5M-xK41Jmp84xP-ICZFXokAbVxNP9DlLN9JW9LVLwDZnsqhJVD4jekivjmOVHVeh2TQaoR9rRdkMdDN3qNFgGltrA2q6VDvK4nJxsP6ZP0Hvsv2Q7UxeEAo_R9SZ4J6JPhCTKXg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 307ms
167ms XHR
text/html 142.251.40.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU5M-xK41Jmp84xP-ICZFXokAbVxNP9DlLN9JW9LVLwDZnsqhJVD4jekivjmOVHVeh2TQaoR9rRdkMdDN3qNFgGltrA2q6VDvK4nJxsP6ZP0Hvsv2Q7UxeEAo_R9SZ4J6JPhCTKXg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KwyhPqL7uRWCUs64M2Gz4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII0JBi-FB_mfUHEJv53Wa1A2IhHo7fT28dZBM4cOdJE6OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLTMzCPLzAAANfeKEY"
content-security-policy: script-src 'report-sample' 'nonce-KwyhPqL7uRWCUs64M2Gz4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 setuid
prebid.intergient.com/ Frame 024B 0
829 B 240ms
158ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=14e76b52-7191-474d-bee6-6fc7cda3e792
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415227&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=O1lV8LT5Hl5GZh0rncT9dm151KKYBwX4UGqjo8HATms%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415227&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=O1lV8LT5Hl5GZh0rncT9dm151KKYBwX4UGqjo8HATms%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946bd641edf4f7dd-LAX
server: cloudflare

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 024B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=

170 B
233 B

457ms
454ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 293
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 024B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDE1NjM3NTctMDE3OS0yYTAwLWMwOGEtZjU2Yjg2MWFlYjdm
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDE1NjM3NTctMDE3OS0yYTAwLWMwOGEtZjU2Yjg2MWFlYjdm&google_tc=

170 B
244 B

160ms
158ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDE1NjM3NTctMDE3OS0yYTAwLWMwOGEtZjU2Yjg2MWFlYjdm&google_tc=

Requested by

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDE1NjM3NTctMDE3OS0yYTAwLWMwOGEtZjU2Yjg2MWFlYjdm&google_tc=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Wed, 28 May 2025 06:53:47 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 024B
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=2d39e49d-c80e-74a4-d56a-afd24cf8251f&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=9444d490-22d8-4620-ba75-e14530a48ee8&ttd_puid=2d39e49d-c80e-74a4-d56a-afd24cf8251f&gdpr=0&gdpr_consent=

43 B
241 B

128ms
100ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=9444d490-22d8-4620-ba75-e14530a48ee8&ttd_puid=2d39e49d-c80e-74a4-d56a-afd24cf8251f&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:46 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=9444d490-22d8-4620-ba75-e14530a48ee8&ttd_puid=2d39e49d-c80e-74a4-d56a-afd24cf8251f&gdpr=0&gdpr_consent=
content-length: 335
date: Wed, 28 May 2025 06:53:47 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 024B
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/b9fe82d9-58a2-e6ed-e4bd-b927b3afe856?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-GbzaGJBE2p9DwfnU.6mQpRU1SxqlHdx9N1A-~A

43 B
98 B

107ms
106ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-GbzaGJBE2p9DwfnU.6mQpRU1SxqlHdx9N1A-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:46 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-GbzaGJBE2p9DwfnU.6mQpRU1SxqlHdx9N1A-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 06:53:47 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 024B
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDay_wALeXrudQA_

85 B
196 B

219ms
218ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDay_wALeXrudQA_
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748415229.388578,VS0,VE0
age: 2562
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/png
x-served-by: cache-toj-leto2350031-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 24856

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDay_wALeXrudQA_
x-timer: S1748415228.656879,VS0,VE93
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 28 May 2025 06:53:47 GMT
x-served-by: cache-toj-leto2350031-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 024B
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=9089992701631137944&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

107ms
106ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=9089992701631137944&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:47 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=9089992701631137944&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 06:54:03 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 28 KB
8 KB 1118ms
1117ms Fetch
text/plain 142.251.40.162
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4864096654546461&correlator=573018270263801&eid=31090591%2C31092254%2C31092626%2C95353385%2C31085776%2C83321072&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1748415227105&lmt=1748415227&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.posambient.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJDQ0MWZjMTcxLTU5ODctNDhiMS04NzliLTZkOGRiOThhM2EyM1gBEh0KDmVzcC5jcml0ZW8uY29tGNXBrK3xMkgAUgIIZBIYCgl5YWhvby5jb20Y1cGsrfEySABSAghkEu4BCghydGJob3VzZRLYASt3OHh4cEdNbXVaV2wzbEllWVZwUkl5Q1VGTkkzdDBJOVFsNHVDbXhlY2NOZGFzQlBIZnFZaGhJVE5wMjdIVnBNSUZQQmxaaDJQRTBqR2xhMzlIbFBlWDA4eWtvWkkzRC9RWnpIdzhVL25HUEgrL1RDMlFWSmNYWmpzby9KWTN3UVcybXVIUm4yS1NBbVRCOHZsMUxmTDgza0J3UXJLOENJQXpsMnJlRUN4SzJuc25lRlluRTNGQ1BPeWVmRW1wL0x0RVRmTWpaUGN2K3dGTDg4T1B5Y1E9PRiTyKyt8TJIABIUCgVvcGVueBjrxqyt8TJIAFICCG8SGwoMMzNhY3Jvc3MuY29tGNXBrK3xMkgAUgIIZBKHAQoObGl2ZWludGVudC5jb20SczE2LXJLRlpUU2lwTUpQc3hjbWFFYVpNbEpMOFNsMTcwRFpySjhLanRkSzRLVWFlNTZBNytxalVHVGZ5cDJHZFJieE5mbGFDRWQzZUd5MjlkeE1tWFJrSkZhYnNKcE9DUDFBZmxQb1l6RjBmTnpySkZRPT1YAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1748415223413&idt=1724&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D883272769c3343edad3054563f7a72e215225373%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqsadv.posambient.com%252F%26tyche_code%3DV.20250527.5%26pageos_code%3DV.20250527.5%26config_id%3D1024872_74068_primary_config%26hour%3D20%26day%3DTuesday%26referrer_domain%3Dqsadv.posambient.com%26OS%3DLinux%2520null%26browser%3DChrome%2520136%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250527.5%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=19078&tan=f2ccd6a6-bf5c-484d-8606-c5cb72b05d83&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d67af389f304c68b9c2855e484f00ef39e8707fee0160371b193a2d6ebe222b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 8524
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame D19F 7 KB
3 KB 793ms
505ms Document
text/html 142.251.40.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.161 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:53:47 GMT
expires: Wed, 28 May 2025 06:53:47 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 212ms
211ms XHR
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

70182e488d1ba9e1a6a1ac5f0f469c1aedc56a061a2cf17a28ae50c4fb58f181

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json
vary: Origin

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 154ms
153ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 946bd643db71092e-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:47 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 259ms
116ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 946bd6431a99092e-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:47 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame 4AAF 0
141 B 545ms
402ms Ping
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 946bd649881052a1-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Wed, 28 May 2025 06:53:48 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 1023ms
572ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 946bd64509c5f7bf-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:47 GMT
server: cloudflare
vary: Origin

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU5M-xK41Jmp84xP-ICZFXokAbVxNP9DlLN9JW9LVLwDZnsqhJVD4jekivjmOVHVeh2TQaoR9rRdkMdDN3qNFgGltrA2q6VDvK4nJxsP6ZP0Hvsv2Q7UxeEAo_R9SZ4J6JPhCTKXg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Pr-FMpTZMs5_qAubGZ48sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2IhHo7fT28dZBNY8fB4D6OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLTMzCPLzAAAMhbKBU"
content-security-policy: script-src 'report-sample' 'nonce-Pr-FMpTZMs5_qAubGZ48sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2

200

9.gif
id5-sync.com/c/483/434/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*-xItVCzZsvfNFK83l7TK7I2ZFUaEmmsKU4BPwAhSmmEea3uMXmESp3B9lpb2bzZu&gdpr_consent=undefined&gdpr=false
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=9444d490-22d8-4620-ba75-e14530a48ee8&ttl=%%TTL%%
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F6%2F3.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/6/3.gif?puid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F5%2F4.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/5/4.gif?puid=71676305-ea9b-46e5-a6bc-1e1ec85d0d09&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=58&3pid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1242%2F4%2F5.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1242/4/5.gif?puid=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/3/6.gif?puid=u_726441ee-7b11-4b17-93a8-1ff9bb88824d&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/2/7.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/2/7.gif?puid=4589633088515201920&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F1%2F8.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/1/8.gif?puid=9ad799fd-01ec-4279-a28d-0fbfa5702fb0&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F0%2F9.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/0/9.gif?puid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0&gdpr_consent=

43 B
1 KB

211ms
211ms

Image
image/gif

162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/434/0/9.gif?puid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:54 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

cache-control: no-cache, no-store, private
location: https://id5-sync.com/c/483/434/0/9.gif?puid=8a249ce7-c2e5-45c1-a0e4-c1a061d802c2&gdpr=0&gdpr_consent=
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 28 May 2025 06:53:54 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-175
x-xss-protection: 0

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 503ms
502ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7f940e1cd898b3ae5055c3230fd3c5378f5f00e53f03afa9c1b621394a09c7d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json
vary: Origin

GET
H3

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame 282E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid...

2 KB
1 KB

90ms
89ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f03bab7c3cd14e0402235b076ea2ddecdabd133b8c974a63289753011a8791a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 946bd648acca08f4-LAX
content-encoding: br
content-type: text/html
date: Wed, 28 May 2025 06:53:48 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fx4onyqFgcOXNx7diZmSncqjR0mc4rmfunOr5CkHbskRmqC1Ll4%2BxRNUgTlr12wyTsacOUAkhEx73%2BzrtcdfHS6lG1%2FNF7jA6htYPqJqhd1KUOOUizNKJW82ETeHLnK%2BB12ly4FAO%2B%2Fhqg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 946bd6481b16f434-LAX
content-length: 0
date: Wed, 28 May 2025 06:53:48 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pn97Tj8oXN1ybUrIF8%2Bm0UvmczvE5oj9M%2FHh%2BP3z3bzYIYhKCg%2FTbLbHLhrg3jnAGpoSH8oCeDZQqL%2FcCN4%2B3ZF3EFvhRsngvEq9c8Arp9GvuoVOyZZY3CpxQWWECykUBcdl1U9L6AEAVw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 288ms
147ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU5M-xK41Jmp84xP-ICZFXokAbVxNP9DlLN9JW9LVLwDZnsqhJVD4jekivjmOVHVeh2TQaoR9rRdkMdDN3qNFgGltrA2q6VDvK4nJxsP6ZP0Hvsv2Q7UxeEAo_R9SZ4J6JPhCTKXg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gTs0O8JLqMpdRqicyEPoeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1ZBi-FB_mfUHEJv53Wa1A2Ihbo4_T28dZBNoaGzOU3JJyi-MT87PK0nNK9FNTCnWBbGLMpNKS_KLUNipZSAVOfnp6Zl56fFGBkamBqZGZnoG5vEFBgB59ycy"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gTs0O8JLqMpdRqicyEPoeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxU5M-xK41Jmp84xP-ICZFXokAbVxNP9DlLN9JW9LVLwDZnsqhJVD4jekivjmOVHVeh2TQaoR9rRdkMdDN3qNFgGltrA2q6VDvK4nJxsP6ZP0Hvsv2Q7UxeEAo_R9SZ4J6JPhCTKXg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-OTQw4Q-cKUmeeOU9ZPmGfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII0pBi-FB_mfUHEJv53Wa1A2Ihbo4_T28dZBM4cPpPnpJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTA1MtMzMI8vMAAAxZwoOg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-OTQw4Q-cKUmeeOU9ZPmGfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxWbRXWQhoahPhPQoWypF3s9EtLNcFrvPxGR_1OzdWB_kZb0l0SHIXop3hEPOmZ5TXTT_BtTboGw8W3_i2AoNPolK2VzAZEqHP6J7h3REP1njpiBMXBnCAFocEOSD8CJyZChvwudxA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 168ms
167ms Script
application/javascript 142.251.40.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWbRXWQhoahPhPQoWypF3s9EtLNcFrvPxGR_1OzdWB_kZb0l0SHIXop3hEPOmZ5TXTT_BtTboGw8W3_i2AoNPolK2VzAZEqHP6J7h3REP1njpiBMXBnCAFocEOSD8CJyZChvwudxA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDE1MjI4LDE1NDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJnUFJEME5GZXE1SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxc2Fkdi5wb3NhbWJpZW50LmNvbSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a5422389d8855d119110bc25e31fbd8ec103ffc7d84d13edebcf74cf853ee2f0

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lrm5mU9MOJuRo-KrQq6_5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:48 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw0JBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F4zcZbrFuBuEn7NmsXEJv53Wa1A2Ihbo4_T28dZBN48HVCqZJGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRmZ6BcXyBAQDaC0VY"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-lrm5mU9MOJuRo-KrQq6_5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 container.html Show response
a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 9021 7 KB
0 0ms
0ms Document
text/html 142.251.40.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.161 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:53:47 GMT
expires: Wed, 28 May 2025 06:53:47 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 318F 813 B
1 KB 135ms
98ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ac19b32a4ea78268fb194564da683aa3cb49ed4f458a41f725b9ee461f2718ce

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Wed, 28 May 2025 06:53:47 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 8674 3 KB
2 KB 342ms
200ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

age: 370
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 946bd649d811cb86-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 28 May 2025 06:53:48 GMT
expires: Wed, 28 May 2025 10:53:48 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 2C3F 1 KB
2 KB 1135ms
217ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 874af7d42d738842c2debfb02d6739bd8bc8a67a9fa7b670ea18c21e0af40159

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:49 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 9C61 52 KB
17 KB 712ms
228ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 82078
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 28 May 2025 06:53:48 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1542052, 128495
X-Served-By: cache-lga21993-LGA, cache-mad22022-MAD
X-Timer: S1748415229.883510,VS0,VE0

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame 3D26 269 B
380 B 436ms
146ms Document
text/html 104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 28 May 2025 06:53:48 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 64B6 0
0 988ms
569ms Document
text/plain 137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:48 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 9498 20 KB
7 KB 131ms
120ms Document
text/html 23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=114904
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Wed, 28 May 2025 06:53:48 GMT
expires: Thu, 29 May 2025 14:48:52 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B66E 2 KB
1 KB 924ms
653ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:53:48 GMT
server: Kestrel
server-processing-duration-in-ticks: 67787
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 884ms
865ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-194-115-33.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
664 B 139ms
128ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 5977816572ed811813845ebccc73075a9aa9bfee9a1ff25ec2c61f211d81a61b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 102ms
90ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0&us_privacy=1NNY&tp=FcG%2F3VWkoM3cYASP%2BL1ZJ6EVHxptBXwVNTm%2BAYU7TzY%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 93e3945c567f3a79d09a2db1f03b273b388bc795fb133067ee86c73b6aa80424

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Wed, 28 May 2025 06:53:47 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
0 8ms
8ms Fetch
text/plain 54.225.240.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwatp7g3sj5ddkb7x71qhe90&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.240.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-240-34.compute-1.amazonaws.com
Software: /
Resource Hash: b66c2bb4094dbceb9759df5e9335119a4cf334983eb825c30b5800d2f308bb0a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 76eb74b6a3747017
request-time: 9
access-control-allow-credentials: true
expires: Thu, 29 May 2025 06:53:45 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Wed, 28 May 2025 06:53:45 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 163ms
162ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=Dz3-Ol9kR29YbWZwNUVEdyUyQmIzJTJGRjNaTDRuVm85Wm5icFkzMnhqSGZ6RnV1WUI5WTVKZTlDZzM4TzN2ckJRdFJqOUdrZ0lXU0c1Q3N4V0lTdTVwSjhJZzZ3UWpBbXdibDFSd2RVZktnQ0M2Y1h3WlZDYXBuOCUyRkt2JTJGQWtxSTIlMkZnbDc1NzM&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 358540
expires: 0
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:48 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8

42 B
716 B

597ms
597ms

Image
image/gif

44.194.115.33
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

44.194.115.33 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-2-v076-078a832fa.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: bfMapY7MSdw=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=9444d490-22d8-4620-ba75-e14530a48ee8
content-length: 189
date: Wed, 28 May 2025 06:53:50 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/iponweb?bidswitch_ssp_id=themediagrid&ssp_user_id=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-yy_cYcxE2pm8O.rYQxDU0LTUYa9LyRUNhafqlQ--~A&expires=5&ssp=themediagrid

43 B
103 B

146ms
146ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-yy_cYcxE2pm8O.rYQxDU0LTUYa9LyRUNhafqlQ--~A&expires=5&ssp=themediagrid
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://x.bidswitch.net/sync?dsp_id=74&&user_id=y-yy_cYcxE2pm8O.rYQxDU0LTUYa9LyRUNhafqlQ--~A&expires=5&ssp=themediagrid
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
server: ATS
x-frame-options: DENY

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 129ms
119ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 28 May 2025 06:53:48 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 296244
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4D1C 652 B
258 B 546ms
168ms Document
text/html 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGJv68KYCMAE&v=APEucNXztNqs5x6Tfa87A0H3Gnd2Sci9k8Q47LZ1W9WS_yVrhg_DZCuClaUwk2Wn9Z101lXpTPq3tGdOxGHNaNS6Hvv1yNH-c7bqWaF2HVVJX8NDe9WgHsY

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:53:48 GMT
expires: Wed, 28 May 2025 06:53:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9021 110 KB
37 KB 513ms
210ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6355a7bcb2412bbb25a722e48636b58b050a7a4af7a68258919f7306e85de618

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 17872117406929459988
x-content-type-options: nosniff
expires: Wed, 28 May 2025 06:53:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38120
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 42 B
63 B 745ms
442ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DgVkXAMFu7svReNeljSYAxouVL_knKJh7LraHzn_OQBwGplGO7-B8fmNJFmDMCO4X9RXjSiAw5ZJF2Jo_6-Rpy9eGiKG0Akap30N8F6-7Kg7XVXfA

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 apis_1_1.min.js Show response
cdn.clinch.co/a_js/api/ Frame 9021 2 KB
1 KB 1296ms
897ms Script
application/javascript 2600:9000:261f:2c00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.clinch.co/a_js/api/apis_1_1.min.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:2c00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

604302d943ca6c7fa6166d82d35c230856151cbbed622293e2b20d34c6cfd8ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: W/"f13651a5834c3412c3a233f57e722944"
age: 1301900
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: e7YCF4YNXFmm0vDWj4jVVLC6BHbkY7TByKRYz2-geXadamjqkqiOKw==
date: Tue, 13 May 2025 05:15:29 GMT
content-type: application/javascript
vary: accept-encoding, Origin
last-modified: Mon, 24 Jan 2022 15:36:43 GMT
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
via: 1.1 d2b8f634cf8ac5ec77dee366297223bc.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 404 mraid.js
a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 9021 0
0 614ms
606ms Script
text/html 142.251.40.161
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/mraid.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.161 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Response headers

cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1591
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/ Frame 9021 3 KB
1 KB 2141ms
266ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/window_focus_fy2021.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 53231
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 16:06:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 16:06:39 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/ Frame 9021 19 KB
8 KB 2009ms
135ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250522/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

760e5d0b97d6707a3d5c2c949bd70e7668484a144f383f3a4dfa878bad15e8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 3000748235154339481
age: 53794
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 15:57:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 15:57:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9021 221 KB
68 KB 435ms
136ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9fc89654aff6bca6c890b30bd0833eb2f18d63a61c0a9ece5246537ad6f73c5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 81102085050987160
age: 2222
x-content-type-options: nosniff
expires: Wed, 28 May 2025 07:16:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 06:16:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69707
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 282E 170 B
188 B 169ms
168ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aDay_NHM4JYADlLvASGYwAAAAcAAAAIB&gdpr_consent=&us_privacy=1NNY&gdpr=&gpp=&gpp_sid=

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sync
thrtle.com/ Frame 282E
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aDay-NHM4JYADlLvASGYwAAA%26448&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=19971746-c2c3-4067-9328-661a943aeb57&us_privacy=1YN-&us_privacy=1NNY
https://thrtle.com/sync?_reach=1&vxii_pdid=19971746-c2c3-4067-9328-661a943aeb57&vxii_pid=12&vxii_pid1=7006&vxii_rcid=1a5f678e-2ed0-4260-881a-b442abfbcd8a&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=HdhDQKUxXct0ey7No291gqL1zvQ&_t=1748415230
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=1a5f678e-2ed0-4260-881a-b442abfbcd8a
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=9444d490-22d8-4620-ba75-e14530a48ee8
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A

43 B
538 B

132ms
132ms

Image
image/gif

52.200.213.72
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Server: 52.200.213.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-213-72.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 06:53:51 GMT
content-type: text/html
server: ATS

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 282E
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9444d490-22d8-4620-ba75-e14530a48ee8&expiration=1751007228&gdpr=0&gdpr_consent=

43 B
769 B

132ms
127ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9444d490-22d8-4620-ba75-e14530a48ee8&expiration=1751007228&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ijdLhJS6ABHL2bKSPyMzueJuKq%2F%2B%2FnLQ6zsqkdmNk3ZQzPdK1fUF5hicwR2TgBh%2FXq7m5oaf29o7WEFG9kfRJC9BoC1YpHEi%2FVTVIx9LFpA1dGsK2RVtzagg9mSANSQMh%2Fw6cykjinPBrg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd64a0e5a08f4-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9444d490-22d8-4620-ba75-e14530a48ee8&expiration=1751007228&gdpr=0&gdpr_consent=
content-length: 323
date: Wed, 28 May 2025 06:53:48 GMT
server: Kestrel

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 282E
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDay_NHM4JYADlLvASGYwAAAAcAAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDay_NHM4JYADlLvASGYwAAAAcAAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

202ms
156ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDay_NHM4JYADlLvASGYwAAAAcAAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: QV2QBEJEFPEVFYQ7ENXD
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDay_NHM4JYADlLvASGYwAAAAcAAAAIB&gpp=&gpp_sid=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: JXXQ6N3PDVKE0SY8MD33
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Wed, 28 May 2025 06:53:50 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 282E
Redirect Chain

https://ad.turn.com/r/cs?pid=21&us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=9089992701631137944

43 B
765 B

120ms
118ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=9089992701631137944
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O5FZVmvNoPZDAySTHaMttA1yFDSb%2BJGvyXjfguozg296cQhIm6csr3twlQ3Z4l5iNqCKcsXttl2qFPeEzb96pxpTv0Ni7zKB6OGW3an5LXvIHrHK4MGvZDd%2BoT7I1GAsWm4oI%2BaQyHZYRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd64a6ebe08f4-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=9089992701631137944
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Wed, 28 May 2025 06:54:05 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 282E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29&us_privacy=1NNY
https://c1.adform.net/serving/cookie/match?CC=1&party=29&us_privacy=1NNY
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=3275294496827427193&expiration=1749624830

43 B
767 B

99ms
98ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=3275294496827427193&expiration=1749624830
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IUbYGcmzGVfSBthZatNHanFAD3vISPr8P5bKhSYGwFC4emK9PmXZGhVV7tTEEIT5Kh%2BDma3Zhu6OkvyIKQM6v7U0RYy1ePxd9JV7QNGqVgbZlzjTP%2FkHjT9oi%2FqtWIC%2BMEqaLzzo1ZJEcA%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd65ebe5c08f4-LAX
content-length: 43
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=3275294496827427193&expiration=1749624830
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
expires: -1
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 282E
Redirect Chain

https://dsp.360yield.com/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aDay-NHM4JYADlLvASGY...
https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aDay-NHM4JYADl...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=bc1afe9a-9b2c-41d7-b440-6fcd5e8d30a7&gdpr=&gdpr_consent=&userId=aDay-NHM4JYADlLvASGYwAAA%26448&us_privacy=1NNY

43 B
765 B

93ms
92ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=bc1afe9a-9b2c-41d7-b440-6fcd5e8d30a7&gdpr=&gdpr_consent=&userId=aDay-NHM4JYADlLvASGYwAAA%26448&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ExB9woMOhheseHH0QeqRJ6vLjLo0%2FKA9Jh1nJoVtf1Xu0zGRjxwlWTNosh4Q4kmkDYfRdzstXnCTuupGhdTca%2Fkm%2F90uYuUTqLjo%2BLLdnHxu2RHM70ggpMgcEE8DvUBx8CYUslLDL9yawQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd6559bb708f4-LAX
content-length: 43
server: cloudflare

Redirect headers

access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=bc1afe9a-9b2c-41d7-b440-6fcd5e8d30a7&gdpr=&gdpr_consent=&userId=aDay-NHM4JYADlLvASGYwAAA%26448&us_privacy=1NNY
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: text/plain

GET
H2 200 sync
x.bidswitch.net/ Frame 282E 43 B
184 B 746ms
159ms Image
image/gif 35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=index&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

GET
H3 200 setuid
prebid.intergient.com/ Frame 282E 0
904 B 331ms
329ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aDay-NHM4JYADlLvASGYwAAA%26448
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26us_privacy%3D1NNY%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=1NNY&C=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415228&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=a7Mx%2Bdkd%2FfQwKnjJnkhdPC8zPfVac1pSW%2FhTyy2RD5A%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415228&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=a7Mx%2Bdkd%2FfQwKnjJnkhdPC8zPfVac1pSW%2FhTyy2RD5A%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946bd64968d4f7dd-LAX
server: cloudflare

POST
H3 204 AGSKWxUT8h8xtywftc7GIU-IAsydJ0Kl6BTEq60eB0Wrmam_keTofJN38PNo_T9xkoX_4qZIj9ER1rJJEyDuZK-8UKCWrD15yUIljmclpYjWWXg_jvKkSvit0S5NP6E9qlBn1kAm1iaaMA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 1058ms
1057ms XHR
text/html 142.251.40.238
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUT8h8xtywftc7GIU-IAsydJ0Kl6BTEq60eB0Wrmam_keTofJN38PNo_T9xkoX_4qZIj9ER1rJJEyDuZK-8UKCWrD15yUIljmclpYjWWXg_jvKkSvit0S5NP6E9qlBn1kAm1iaaMA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3l_Ozjt3JaVokpef_wEiQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1pBi-FB_mfUHEJv53Wa1A2IhHo4_T28dZBNoWPX_NKOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLTMzCPLzAAAM3uKCw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-3l_Ozjt3JaVokpef_wEiQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 318F
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=4589633088515201920

43 B
61 B

98ms
96ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4589633088515201920
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=4589633088515201920
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7c1be5dc-2096-4d3d-858e-a7bfcdec56d7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 318F
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=090a922b-fae8-499e-9670-8b037795210d
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=090a922b-fae8-499e-9670-8b037795210d

42 B
319 B

135ms
134ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=090a922b-fae8-499e-9670-8b037795210d
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=090a922b-fae8-499e-9670-8b037795210d
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 318F 95 B
768 B 512ms
97ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=5ab29eb1-6ca8-4279-83e8-93267d8281d9

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 318F
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=

43 B
61 B

92ms
92ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 318F
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=2d5ca1dd-d8ea-45e8-a5ca-87f3f8d633e3

43 B
61 B

166ms
165ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=2d5ca1dd-d8ea-45e8-a5ca-87f3f8d633e3
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: 5b6878cb-a0f1-4559-ae3d-75f2a941f930
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=2d5ca1dd-d8ea-45e8-a5ca-87f3f8d633e3
Content-Length: 112
Date: Wed, 28 May 2025 06:53:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 318F
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=g5pncZ4pxtAvfUdHnRd6bw==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
108 B

95ms
95ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 9498 5 KB
6 KB 1021ms
126ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=61297806&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 456889d07bd0523daffbf45b9ab9638f4f95f2a9e9484ab4140789cd90aef146

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 28 May 2025 06:53:47 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4589633088515201920

86 B
1 KB

157ms
156ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4589633088515201920
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415229&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=2B35CwIzsQEG8dUnJ3x9EHstqbyw4htLKmegTJqT6B0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415229&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=2B35CwIzsQEG8dUnJ3x9EHstqbyw4htLKmegTJqT6B0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946bd64f2b2d7cf8-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=4589633088515201920
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 584.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: bc3c9e94-a8ab-4b71-82d8-e30ec352fd57
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 3D26 44 KB
11 KB 140ms
139ms Script
text/html 104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 56524eddd32d063ae05e13e3617e2f47e15a533e15a69f483ff4c24bea89fb3a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=73384
content-encoding: gzip
expires: Thu, 29 May 2025 03:16:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11450
date: Wed, 28 May 2025 06:53:48 GMT
last-modified: Wed, 28 May 2025 03:16:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4D1C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0

43 B
763 B

87ms
87ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGJv68KYCMAE&v=APEucNXztNqs5x6Tfa87A0H3Gnd2Sci9k8Q47LZ1W9WS_yVrhg_DZCuClaUwk2Wn9Z101lXpTPq3tGdOxGHNaNS6Hvv1yNH-c7bqWaF2HVVJX8NDe9WgHsY
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wPGqQ1UbN8iuS2g3FzGHK8kWiUoWWUExrllTS3ss5E0DetGL585W5WTAjG5toXlqmPqFvG1hJlchkKX4SH3%2BVJWYGfosPOGeDen8z8ZDIR547Q5oOFeoTw3nJabVYBT8fi5%2FIhD8EbZLJg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd64ddaae08f4-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 299
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4D1C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aDay-NHM4JYADlLvASGYwAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
768 B

82ms
82ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGJv68KYCMAE&v=APEucNXztNqs5x6Tfa87A0H3Gnd2Sci9k8Q47LZ1W9WS_yVrhg_DZCuClaUwk2Wn9Z101lXpTPq3tGdOxGHNaNS6Hvv1yNH-c7bqWaF2HVVJX8NDe9WgHsY
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xRFG0OB%2BVUMcGkFPdOveqWEKHbXDt%2B9FYXD8m6HDr9D4FjEFH8swDQvDgihuc8dMkm43bXgY3kyBwoWFBexDR0rG8KbH2wsOm9pcgyznER4guEE5%2BsxPMaUfbQ%2Ff15uSkUcgVJzmJ0bvDw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 946bd64e5b4d08f4-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 4D1C 170 B
188 B 165ms
164ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIPa754EEJm3-qIEGJv68KYCMAE&v=APEucNXztNqs5x6Tfa87A0H3Gnd2Sci9k8Q47LZ1W9WS_yVrhg_DZCuClaUwk2Wn9Z101lXpTPq3tGdOxGHNaNS6Hvv1yNH-c7bqWaF2HVVJX8NDe9WgHsY

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4D1C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTYzMzA4ODUxNTIwMTkyMA%3D%3D&gdpr=0

170 B
188 B

155ms
154ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTYzMzA4ODUxNTIwMTkyMA%3D%3D&gdpr=0

Requested by

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31532338.ip-162-19-138.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU4OTYzMzA4ODUxNTIwMTkyMA%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 8c1cc303-1dd3-4251-90c5-402278e722c7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:48 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 223ms
221ms Fetch
application/json 162.19.138.83
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.83 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

63a74acd7a0d2188a75b6e609f7f0fd38d8f290243b18063ca71c6069d8e1829

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Wed, 28 May 2025 06:53:48 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 0
20 B 158ms
156ms Ping
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1171230660695&version=m202505060201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 0
20 B 165ms
164ms Ping
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1171230660695&version=m202505060201&ct=77&x=1&cor=6996404437487368000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9021 45 KB
23 KB 241ms
240ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIohPT5zQtSJxg80qfSLT28RK8nXhD1J8_Z5fJzHxJTs5ywK1e8KG8IKB4oRU3M0cE36t1euF1mSxKgiNwxnYph28OdVy1Td1DIZdYXSNb6RbSKGtk3KrsnLNQSWlrgdCeRLSKLYjBIp3UJTFdY8Ag-8hnhN2WQQD3G8hi81YNP5OhAlA7j6hSXTZ89qa7R9OdcfnikqH5u54XzkcMt2xpd540cDBkedCUAWaNTMZ8zXuHfaFDNuARK2ms2ZHdcjmtlS_Db37tnDp8LyalMSvj1bFW4w&dbm_d=AKAmf-CiDiZYfKNW6NbcXrJJmbVuEbkvhn1mhbbqP8IRix5gDn0f-kyOCCcTTni2jAXmBXZ0J3yhhlu8RpCa7p7OU9e07HiCYsmVBpPT0iAq-FTztFx3PL6XC1J0697f_--M4vm0GRCivB8XM6UNuPGOvTz2C_i_wV2KtfYiKS6uCLOJmzSg0RqQGtdixg2PAgJ7qCK8RXhyJroi1cU05SIIb_bLKSakdZr1_7EQPwdXanbfi46oYC0NlkAc2hefbahsqA9tYOL69-WyjXVdmOUW7MFdr6nl4CrRKGYe99urganD-gukIXOCkGrcXYw681CXkwu9dLgrisc5qvKFmKhSXR9gnomIJE6img2vi0edXd1M8-hIbP6wEkyahH5Ux6LJ-fBtOIS0qpr1-OMSv3XkUews2l71gx7Siwe4L40fBdUMjYk9ye2XfwyFyQOfwRcm619GxxBctIJusSZ9r5jWO3F4xByfgQyUTBa6eIaeUNpMcTLoq-Z179DumtVdGjOR91zVmyivZWrJJ3B2oyB_IlR_3gJ7O2_xekWVcKc9HUhFoDb3cXG5jxgVe5Q52rrSsCLOYG26CE-tPLed0-sRdYWl78sMfkoWjbeexZ8XirpFW7OsDndyDfmEm5Owe_qfVbQxyOVAWTzTKqUN5m73ZHxEwlsW-zY0Ek1Y6iYr74jyT9RWwKhCnhrSjNf7kA-gtSPT7TDEsdQGj-enUFTA3R7hRnAIsx1AZW994xXgWDtNMAlPeSMXhlm3i_QI9fOHhOUaM1pviHAkosPc86lLdJ1b1fZkSnnGU7jW-v9nDHeVByVKBVnsXZtCwKhAc7Hue-HyZyJUW813lS1zNmLX8lS_eFa7w_uLF6tk68grbF2KM7KptKP-xJxoMgVyL5cF0a2ZawzWudG1gP7WKxWK1oLFDgFTbb1_O1S19Vrqt9X5nBU1wfrlechMH-voo75S6lZhEI57vwkfzLbi-BG2JQUIVyms-x3UTeV58p9l-3P7gChl2FNzpULDPu8sxLnW6EAPkmh-iZCoH99rbBOP4mqnMW-K6gmd5WEGSD4ndHkaBfXUah0h_RUED3dmqPIG2WwfAXNJdBXEr7N9nCieK01pvtLNyWyX9tO7z_Bt8zXykRCQzup6AkZ_NHILKaKUQabEm1PkyWTgusRtCyc_GnY7xCHDa74h7nsQz2lCF8mHa_Z6Undiv3fjIOPzXImz7MUfA6iIeLpdkSjYGk_gKp4kLFMLsNOWeHlt0oK7wJ_iTtolJDwx3-4_GLhw0cGq2uddRsZv6IDtxh-GnKuoGG0Lsu1QoO0WSL0eK6pTiL7CGnqQoatjH1yJT6gN7u3X3Z14nItUB6rLgILgO2t858Fly_8KnGBahkJiuWGPyQ_7xbjvgd0YEQP9LyXcgLxLRnK6bdrEQxsTxubTk7wI-sf67ziKmpikqXze1eAAEPjBh_3FjD1h6BLN4035O1BmrvLso-twF0m-VxibLU-Cv4mehJbrf4a5z5Qn2HfcRKHsjDNh19-v2Z6z9FHrikvfryGM-uDQVMEl0CAurl3iWMK8d4ynzQXw8cdHpU6RP1jtdOrcbO1Bh3IZFavpveBSo40c43s3HDgGEzFiCyDghDlNDlJ1A2Vktvr0wk4qQF4vz58lRp4Il44VUjFeOiHR1ExpCXkapgwPkouexwVRsJLAl6Cz5LNCtjo4UooxNqZMOTaJJTi836XOQotOZj_rDf7DNZMX9bveh6HK-sdimXzkESwOOLnh9iXgvXJz5SvitliVEGbWC4J-x9y-lAUYdRxr_XQAxYi1sifz4FhxHte5P-nsZM-723VUQGdOd1HZ5PHgiDRjJ8MJXFn-iGDFtbOYNAXJQKta72Te7KTN9QORiRMDKuGioo2d2tyRtFbY3vFAOu-ID2TZRVS94xsDeLUz1zxCtjcrpXEoObt3tGjrbSTkruSuGh6-RAlzrSlC6DVLrqbqs5lIGDvOteWnHzVYbpPh7GSh1wbd_CEUNyyuOZUCDo1THEd6eullZhbacRbhEfjLaSxS9bPHrup-H4NN4hUjznN9AxW_JI0M0MYd69FCY5gDpCmZ5jw0EgLf-qZGzQOojE4kfdY3aaaml0JM6smS2XxURk0MFz08kva7pOADsmSjuHX0hGWWD93DGReq8dkN5wbgtJWruhIsZ1peDxjM18GFHnL-cvhKhBo_gDt94iAlKV3TezS0_wlXTVrBxaLkNIzxzxlbJl9jvKOgIW9QaK0bmDHthHkUIZm4zrOP0-ANpE55BTgB51dBy8CxZHz47hjAwaB4RSdFDXFtGz5_nFwj-OEI23PGTa_8hgBNEdalAZZrQrvmwIiBPjtGgZjI6DH_zZKOOXLaTs_KD28550sjgp7EYgpm4banOaydAX5ff7TzaYBqK9d7G6t2Nakw330zOUvzW1ObjRoj9hDqD-Ds7JU8au7omrpG8axMJiPwaNxO9oGZVx-Ca-nVujWZUVhXQ1B9nwgLyk9fjj9qc5WJRdSSXBWr_htkDzACmf6h_pW4kAK3ezZRqyMO3PPTBxquveYQ9erYwQ4vVog7yjoze_EKFpVI65GHpEoiDLPwhPNxGoSzBBa3uskek4Hh8MvKA_mHoN4sVySnvSbTb-BLtI5tiYd18MP_NHKtnbFzyFmsNQD9fybYAQup75pT33x_LSalAxFWtGeAbyZtMrze3jn3ze8ehsVPIPrstkBHUk-UphTJ4qV0G8URjInXcM3-ppfqS8n7aZTIWfYV4lFEjLIi-40IN-ZLWcG1Wg7z63bm70_RwbDDkIw8LBIfTnUvJWMu5k7dYWOXhx-Ts0MtYPPGNu5qxud1xnsXknSY27ph8Lr3yau78-qkMiDvioX-L1v0N082W_bO5eNU5mej8hn9Skvk6k0U2NyOpIF3SOG3vk7wG0y5K4VJ3VXyKQVPHhlFgPJmM-S61JRiYp3MjKo6a0gTgclXHilqY-PoqpwwQkt-e3iukfKLg0FfC-6SVL8zNoyL5ZT5x_8QYSy0RkRU4n1DgEEPFUKyYZ64ScH3szrSjkbjkHLonAysiwrOMtsJZLKUcaFHtwO81RLUTThouLHRF86kZwfUm-gDRgAP3BTZvz1dZuf228t-7XT4pM3Fnh6iqMgRkOfsohCVy7CnjCjdHFDg4Z_2Rginm3yvP7dNjoHmjynaWwstY3qL96C5HwfnN7TXKkisW4BYftB2UmMNntO5mNposdoNWQ3X7trzub8pEoaUvL5eVF8WNzCQ9zsigl7pnIVRvD73iluik_Mh_QYju7XRJuNMl7a08oHW4jgp9b7YBcb09ZG33D3rTlPXnojABhC-bqnv_27InBKp9L0JNmMnuQ_yPX6XVQrl70RnmUKAvVnDRA5v5wQOcotKhcf-S0uMblA4TEqmjs75mNvkM9BmtZS5axtbESEOryHvpSNJfqMpRQS3W-CBsNAdoBeSbkll61xmde4pSKD6qG5lWKKZjsdlK-stYqJX1afDcUlaNaalOauEPnzH5QFClJu5VeXW9iP0Sqa7Me-8ipENZAY0UPgUuLiyEg6dvxpsqylY9D1SfmKhTcIt6fkAG-dWSQaiWqrB41ObySGoSndOcpM66wVETHb4cDfWaGHC6Fc3SXuxmpeJK_Ct1jUi6uPXyYonlwEbTHqHMAvH141BpqP-VD6tF4z3VTqvb1lft-fZFSD2jqYKGCPEK5pKJW15dbuopi4i8ntvaqJE55iyCKm1Zrw5C-pWeC5ENo7JzlZv8lgvTPJ5BDE8_4vjTkCCFO8hgra26X_EXH4QbKbhG90lbXyVaTeN9uInlZhchmS1gYbIp_otgXnqf-7SuM157ZdZyzla6DQrKi1rOHXZIJSlBzqzTlrQTVDrf_w61g7fwxnynv2iUGzui_hAixepD6v3fiGeE21Hh4jnUEyCVwTryqRJ4FXdlKngEMt3H10-PxMwYarkUb5bFru-Osa8CoVeaa_KLU1AhETvRVS6MnCa2EsV7sWDi6mNMTvb54DvAjWniBUN7ApdKnQ3Qx9eHYHdkkHDFnkzAifM9G78a8cpBI_8Ncu1RTs8RWO5pPZZhw-Diqg2jakrkqxHALY1djC8nZJcv4qu4AJjJDqN6G7nWt2ljakhaEjzRalGwb2ZaSRWsX2un1ti4d0aBdRRMa75xMIHCgQRa4v4ft-G17ZryRqOAbavnm3kwAJLxYOnf5eInDxB_M-1DY3fJwbXcTuytXnabS2GeI1zGp9G4oQ_sNT6rOyhYOanKMKpFbtHtDj51Vpd3fPiDQ5cJQkxBgzTeJ1nMW6J1qTQF-18qgNgPF7YeFmM4asiwiE-h0o0jFmoA2wF9wNxDF8KhYnnhqVxZMNWiqE_AlaY11Hm_3Ya-Q1MTGulYPWNW3jJ4AZIJfenipnz5p7iHP_2X7QjygA5Y8USfbNvdCdUQLu8yRGav9Vk67dbp8S2Fp6v1vFxBVBmKKLwc2ZieNsSSFtXFsSuzlazQLLpj-9CrYQILZDFQgBGrrVrJxPhRqOJQYPJ56t_wVv3d4eIdQ_oXS58xgb-4kXAeEOWulC9gvPPIYyKZOuIxE4pHBuzmpLyjiwtEMJTjSSNz875yXQ9YLi8umtk0WfY_TV07M2FjThNtFrLVAEG-loJLI2r6vWmKS8PnGGR2K2JwgtAm66-SB0HJHi6Fx1vlVJ98O0U-bENRs2jIjt-LxBOE0D6ukbNqsFGTSacmR03ocHS2fMEzq5WSB9ObzCProb2cYC5E6k2_jdp_ce3a0ME3wct9WiZWOR7acGahcYOAacskQ34Zt2IMu7H9Ls0MrVnsbMfYgA2djVslnWzS7poty-kuEukzX2j9dyOv13n2ne5WkhttQfUD0XwiDXMbvKamLB8SMVy4rHVNXs9PiRRLUxBnW1e_l506hQDSmxN8S4IoI2jPQaDl_Le&cid=CAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=6996404437487368000&adk=4188270524&idt=870&cac=0&dtd=56

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f2.1e100.net

Software

cafe /

Resource Hash

053ed07196800c7c1e9dcfbf3713e5f02a31b5b7e4f69f0dcd8ffff6988d499c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 23473
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 146ms
146ms Fetch
text/html 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lga25s80-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 866ms
865ms Fetch
application/json 162.19.138.120
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Amsterdam, Netherlands, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

72687ffaaea22652375fa0b8a990adecbcccf71ffb0feb0fa8cd805a25fac5a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: application/json
vary: Origin

GET
H2

200

xuid
eb2.3lift.com/ Frame 2C3F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=9444d490-22d8-4620-ba75-e14530a48ee8&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
477 B

145ms
145ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=9444d490-22d8-4620-ba75-e14530a48ee8&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=9444d490-22d8-4620-ba75-e14530a48ee8&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Wed, 28 May 2025 06:53:49 GMT
server: Kestrel

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 2C3F 170 B
188 B 158ms
157ms Image
image/png 142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2C3F
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE2NjI5Mzg5Mjk1NTk5NzM3MTE5Nw%3D%3D

170 B
188 B

154ms
153ms

Image
image/png

142.250.65.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE2NjI5Mzg5Mjk1NTk5NzM3MTE5Nw%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE2NjI5Mzg5Mjk1NTk5NzM3MTE5Nw%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 06:53:49 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 2C3F
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTE2NjI5Mzg5Mjk1NTk5NzM3MTE5Nw%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
140 B

156ms
152ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 2C3F 0
250 B 576ms
365ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1166293892955997371197&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 88EE0495E11E4E6496E130D1E8661EFD Ref B: LAX311000109017 Ref C: 2025-05-28T06:53:49Z
x-li-fabric: prod-lva1
x-li-uuid: AAY2LKSv2u2Kd4XLHVdD7g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT

GET
H2

200

sync
thrtle.com/ Frame 2C3F
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1166293892955997371197
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=19971746-c2c3-4067-9328-661a943aeb57&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=19971746-c2c3-4067-9328-661a943aeb57&vxii_pid=12&vxii_pid1=7006&vxii_rcid=ba4776dd-8859-481e-ae83-0dce18090480&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=HdhDQKUxXct0ey7No291gqL1zvQ&_t=1748415230
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=1a5f678e-2ed0-4260-881a-b442abfbcd8a
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=9444d490-22d8-4620-ba75-e14530a48ee8
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A

43 B
538 B

139ms
136ms

Image
image/gif

52.200.213.72
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.200.213.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-213-72.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Wed, 28 May 2025 06:53:52 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-rIv75v1E2oTXTQfZN6i7lc938jUElsKvTBYT6Q--~A
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 06:53:51 GMT
content-type: text/html
server: ATS

GET
H2

200

xuid
eb2.3lift.com/ Frame 2C3F
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1166293892955997371197?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-BIyVjedE2oRxmVYo_tSX2L1DFzofjVuARKAeAbOyKw--~A&dongle=0883

37 B
477 B

160ms
157ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-BIyVjedE2oRxmVYo_tSX2L1DFzofjVuARKAeAbOyKw--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-BIyVjedE2oRxmVYo_tSX2L1DFzofjVuARKAeAbOyKw--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 2C3F 42 B
693 B 394ms
160ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1166293892955997371197&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: 146E83A7AA0646118B4A4AF990E9D7FD Ref B: LAX311000115049 Ref C: 2025-05-28T06:53:49Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Wed, 28 May 2025 06:53:48 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 2C3F
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=20d11f05859e1165&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

139ms
139ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 28 May 2025 06:53:51 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 2C3F
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430

37 B
474 B

151ms
151ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-1dd84340-a531-5dcb-747b-2ecda36f7582$ip$162.245.206.244&dongle=4430
Content-Length: 141
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 1560 4 KB
5 KB 136ms
133ms Document
text/html 137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 265ecdd4fc0b5e75d3f4f92514ea15e6e06b264cd29f0cbfbec4d5712434d2e2

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4157
content-type: text/html
date: Wed, 28 May 2025 06:53:49 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 1A2C
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=

35 B
591 B

1460ms
1456ms

Document
image/gif

185.167.164.40
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.40 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Wed, 28 May 2025 06:53:50 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame D6A5
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

362ms
151ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 28 May 2025 06:53:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: PYYD75K0PT4S9SR1PW9J

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Wed, 28 May 2025 06:53:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: WXVCEXV607MCQ93Y517G

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 674D
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4589633088515201920&gdpr=0&gdpr_consent=

42 B
297 B

1035ms
130ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4589633088515201920&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 06:53:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 84c918f6-fdaf-41d0-81c7-1b1f887eabac
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:49 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=4589633088515201920&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame C638
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFKN2YwN1FiV1lBQUJ1bEtqaUtrZw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AAJ7f07QbWYAABulKjiKkg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1786129491561635162&gdpr=0&gdpr_consent=

43 B
433 B

129ms
127ms

Document
image/gif

3.210.126.173
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1786129491561635162&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.210.126.173 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-210-126-173.compute-1.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Wed, 28 May 2025 06:53:51 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1786129491561635162&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame C20D 0
340 B 1623ms
312ms Document
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Wed, 28 May 2025 06:53:50 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame D772
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=979321857856590673
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

145ms
142ms

Document
text/html

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Wed, 28 May 2025 06:53:51 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

cache-control: private,max-age=86400
content-length: 178
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:49 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame 56CF
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

302ms
133ms

Document
text/html

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Wed, 28 May 2025 06:53:51 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

cache-control: private,max-age=86400
content-length: 178
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:49 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame 2F55
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
150 B

762ms
761ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDay-QAEybYwtQAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2562
cache-control: no-cache
content-length: 85
content-type: image/png
date: Wed, 28 May 2025 06:53:49 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 24863
x-robots-tag: noindex
x-served-by: cache-toj-leto2350031-TOJ
x-timer: S1748415230.948648,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDay-QAEybYwtQAw
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-toj-leto2350031-TOJ
x-timer: S1748415230.624955,VS0,VE95

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 68D0 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E9D3
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&gdpr=0&gdpr_consent=
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=3e4a83bb-e65b-4d4c-a88e-2d715150f4b6&ssp=pubmatic
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
201 B

140ms
139ms

Document
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Wed, 28 May 2025 06:53:51 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame A9CE
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=d751d103-5e65-45c1-826e-2e0146826e91&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF

42 B
491 B

148ms
147ms

Document
image/gif

3.215.67.115
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.67.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-67-115.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Wed, 28 May 2025 06:53:50 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Wed, 28 May 2025 06:53:50 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4FF8
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw

42 B
245 B

740ms
129ms

Document
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 06:53:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 946bd652ad1e52a7-LAX
content-type: text/html
date: Wed, 28 May 2025 06:53:49 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
x-function: 209
x-reuse-index: 1131

GET
H/1.1 404
Not Found d0d3910d86e99acbd84ac90b691dc0c5.gif Show response
cs.krushmedia.com/ Frame 0839 9 B
519 B 1733ms
144ms Document
text/plain 80.77.82.130
NATCOWEB

General

Check archive.org

Download Go to

Full URL: https://cs.krushmedia.com/d0d3910d86e99acbd84ac90b691dc0c5.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&ccpa=[CCPA]&coppa=[COPPA]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 80.77.82.130 , United Kingdom, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/plain
Date: Wed, 28 May 2025 06:53:51 GMT
Expires: 0
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6A35
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=3ca4e4bb2c807fbd&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUdea9789e4f23474aa12ab955d10b33c9

42 B
393 B

125ms
121ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUdea9789e4f23474aa12ab955d10b33c9
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 28 May 2025 06:53:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:51 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPUdea9789e4f23474aa12ab955d10b33c9
pragma: no-cache
server: Tengine

GET
H2

200

cookie Show response
sync.cootlogix.com/api/ Frame 8E22
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=DFDHUlhakgEXCcwBD1DZVFxax1EXXpJVXl8yQyL4
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
495 B

441ms
136ms

Document
text/html

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4eef8263281c0b26486637831251059757bc3fdc4c3a48045a8ef8646b36e8f

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 43
content-type: text/html
date: Wed, 28 May 2025 06:53:51 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

Redirect headers

cache-control: private,max-age=86400
content-length: 178
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:49 GMT
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 6657
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
93 B

492ms
131ms

Document
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame E7B6 43 B
347 B 292ms
126ms Document
image/gif 35.186.193.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Wed, 28 May 2025 06:53:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
via: 1.1 google

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame 1E3B 0
181 B 431ms
135ms Document
text/html 159.203.147.11
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.147.11 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Wed, 28 May 2025 06:53:49 GMT

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame 9498
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

127ms
126ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

mw
mwzeom.zeotap.com/ Frame 9498
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-QfkRN2tE2pS17ZzwKccpjgPQ.uGZgL3RpQ--~A&gdpr=0
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=9444d490-22d8-4620-ba75-e14530a48ee8&icm&gdpr=0&gdpr_consent=&cver
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=f0665434ebb256fdbeff37839cbe510f&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=5ab272241a74f4fa
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=89d76764-5fa1-43ff-605c-5dae66378583&reqId=ed077fe1-d070-4a4b-7219-cb6c6c89d976&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=89d76764-5fa1-43ff-605c-5dae66378583&reqId=ed077fe1-d070-4a4b-7219-cb6c6c89d976&zcluid=5ab272241a7...

95 B
189 B

225ms
218ms

Image
image/png

2606:4700::6812:1572
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=89d76764-5fa1-43ff-605c-5dae66378583&reqId=ed077fe1-d070-4a4b-7219-cb6c6c89d976&zcluid=5ab272241a74f4fa&zdid=1332&google_error=15

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700::6812:1572 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 946bd666deb408da-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Wed, 28 May 2025 06:53:53 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=89d76764-5fa1-43ff-605c-5dae66378583&reqId=ed077fe1-d070-4a4b-7219-cb6c6c89d976&zcluid=5ab272241a74f4fa&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Wed, 28 May 2025 06:53:52 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame 9498
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=9444d490-22d8-4620-ba75-e14530a48ee8
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=9444d490-22d8-4620-ba75-e14530a48ee8
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=4589633088515201920&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=8870183159921614382&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
153 B

1007ms
1006ms

Image
image/png

151.101.2.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDazAAAADT4jygBK
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.2.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748415233.615631,VS0,VE0
age: 3126
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Wed, 28 May 2025 06:53:52 GMT
content-type: image/png
x-served-by: cache-toj-leto2350031-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 303

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDazAAAADT4jygBK
x-timer: S1748415232.299597,VS0,VE87
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Wed, 28 May 2025 06:53:52 GMT
x-served-by: cache-toj-leto2350031-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RkE5RDRBQzctM0FGMC00QzkyLUE2QkYtMjgxNDUzM0NEQ0JG&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
246 B

326ms
127ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 9498
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=-p1KxzrwTJKmvygUUzzcvw%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

10 KB
10 KB

137ms
136ms

Image
text/html

23.51.57.13
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.51.57.13 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-51-57-13.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=114903
content-encoding: gzip
expires: Thu, 29 May 2025 14:48:52 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Wed, 28 May 2025 06:53:49 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15

42 B
95 B

632ms
305ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 333
date: Wed, 28 May 2025 06:53:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FAA4D05CFB1743A0BB5A3D89585932CC

42 B
287 B

370ms
369ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FAA4D05CFB1743A0BB5A3D89585932CC
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FAA4D05CFB1743A0BB5A3D89585932CC
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Tue, 27 May 2025 06:53:49 GMT
access-control-allow-origin: *
content-length: 142
date: Wed, 28 May 2025 06:53:49 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9444d490-22d8-4620-ba75-e14530a48ee8&gdpr=0&gdpr_consent=

42 B
313 B

1059ms
134ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9444d490-22d8-4620-ba75-e14530a48ee8&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9444d490-22d8-4620-ba75-e14530a48ee8&gdpr=0&gdpr_consent=
content-length: 355
date: Wed, 28 May 2025 06:53:49 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ts.RBttE2uWmTfChHwxM0wdg1k3Zx_8-~A&gdpr=0

0
260 B

987ms
707ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ts.RBttE2uWmTfChHwxM0wdg1k3Zx_8-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:51 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-Ts.RBttE2uWmTfChHwxM0wdg1k3Zx_8-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Wed, 28 May 2025 06:53:50 GMT
content-type: text/html
server: ATS

GET
H2 200 FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 9498 43 B
521 B 673ms
668ms Image
image/gif 2600:1f18:4e9:5a01:1cb2:c061:ea6e:bea1
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:1cb2:c061:ea6e:bea1 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=71676305-ea9b-46e5-a6bc-1e1ec85d0d09&gdpr=0&gdpr_consent=

1 B
236 B

850ms
134ms

Image
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=71676305-ea9b-46e5-a6bc-1e1ec85d0d09&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: text/html; charset=utf-8
server: nginx

Redirect headers

X-CI-RTID: fd234288-884e-435a-87b7-7c2e4d446beb
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=71676305-ea9b-46e5-a6bc-1e1ec85d0d09&gdpr=0&gdpr_consent=
Content-Length: 205
Date: Wed, 28 May 2025 06:53:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=2ac35bcb213013ad&is_secure=true&networkId=17100&version=1&nuid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&nuid=FA9D4AC7-3AF0-4C...

42 B
373 B

138ms
137ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&nuid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&expiration=1748501631&nuid=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Wed, 28 May 2025 06:53:51 GMT
pragma: no-cache
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 9498 0
164 B 1770ms
540ms Image
text/plain 35.174.227.121
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.227.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-227-121.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Wed, 28 May 2025 06:53:50 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 9498
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=

42 B
391 B

400ms
128ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=16241d4c-0908-48fe-aa77-a6d915418f08-6836b2fd-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Wed, 28 May 2025 06:53:49 GMT
server: A

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 9498
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8870183159921614382&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY

43 B
496 B

131ms
131ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

cache-control: private,max-age=86400
location: https://sync.cootlogix.com/api/cookie?partnerId=pubmatics2s&userId=FA9D4AC7-3AF0-4C92-A6BF-2814533CDCBF&gdpr=&gdpr_consent=&us_privacy=1NNY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 178
date: Wed, 28 May 2025 06:53:48 GMT
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame 9498
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA5_12903434C_28BF3AF6B&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

132ms
131ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-431420031; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-431420031; includeSubDomains
Cache-Control: no-cache
Date: Wed, 28 May 2025 06:53:51 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:51 GMT
server: nginx

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 101ms
100ms Fetch
text/plain 216.239.34.178
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55q0v9101576445za200&_p=1748415223429&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&cid=1873605099.1748415225&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=AEAAAAQ&_s=2&sid=1748415224&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsadv.posambient.com%2F&dt=Paint%20with%20Oils&en=scroll&epn.percent_scrolled=90&_et=6&tfd=6859
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.239.34.178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:49 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 setuid
prebid.intergient.com/ Frame 1560 0
1 KB 156ms
153ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=bb702541-49c9-812d-2940-f4575f73e452
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748415229&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=2B35CwIzsQEG8dUnJ3x9EHstqbyw4htLKmegTJqT6B0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Wed, 28 May 2025 06:53:49 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748415229&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=2B35CwIzsQEG8dUnJ3x9EHstqbyw4htLKmegTJqT6B0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 946bd6513c3af7dd-LAX
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=4589633088515201920&gdpr=&gdpr_consent=&us_privacy=1NNY&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHLzDLw2KBSRuUVNu3&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

128ms
128ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:55 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1560
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%...
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=-1&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=f08cb00e-0eb8-433d-bb80-f661b6a350be

42 B
286 B

420ms
418ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=f08cb00e-0eb8-433d-bb80-f661b6a350be
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:52 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=f08cb00e-0eb8-433d-bb80-f661b6a350be
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Content-Length: 0
Date: Wed, 28 May 2025 06:53:51 GMT
Keep-Alive: timeout=1, max=497
Server: Apache
Connection: Keep-Alive

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY?gdpr=&gdpr_consent...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHLzDLw2KBSRuUVNu3&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

150ms
135ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=1NNY&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=OPTOUT&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHLzDLw2KBSRuUVNu3&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

149ms
128ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=1166293892955997371197&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

141ms
127ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:57 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY&sovrn_retr...
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=1NNY
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

152ms
148ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame 1560
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=1NNY&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%2...
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=-1&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=ce76dc44-da7d-4656-9798-adff3d59fc9d

42 B
208 B

138ms
136ms

Image
image/gif

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=ce76dc44-da7d-4656-9798-adff3d59fc9d
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=ce76dc44-da7d-4656-9798-adff3d59fc9d
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
Content-Length: 0
Date: Wed, 28 May 2025 06:53:51 GMT
Keep-Alive: timeout=1, max=498
Server: Apache
Connection: Keep-Alive

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=f77bb51b-8f37-4a99-9ae5-b3628fa54d83

43 B
496 B

129ms
128ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=f77bb51b-8f37-4a99-9ae5-b3628fa54d83
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=f77bb51b-8f37-4a99-9ae5-b3628fa54d83
content-length: 0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=1NNY&userId=ID5-5-f197b540-71d7-4c00-99eb-8e80e2554312
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

133ms
132ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 06:53:51 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=f3d858f7abfc14a33f617fed810198f&_fw_gdpr=&_fw_gdpr_consent=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

141ms
131ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 1560
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3914168302251682000V10&gdpr=&gdpr_consent=&us_privacy=1NNY
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832

43 B
496 B

140ms
126ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=054238f42d579832
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: 054238f42d579832
Server: Adtelligent

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame F48A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

137ms
136ms

Document
text/html

104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 28 May 2025 06:53:50 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H3 200 cm Show response
u.openx.net/w/1.0/ Frame 6FA9 909 B
929 B 242ms
238ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 90d82a970c6ced47343260539e51aa5e190797c86a04cc7adadf65a8b4f8a927

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 909
content-type: text/html
date: Wed, 28 May 2025 06:53:48 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H3 200 cm Show response
us-u.openx.net/w/1.0/ Frame C07E 911 B
931 B 106ms
103ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d45efa3a274fc3a1637e6a1a5e9345f090cd48a6b0e03bab48e189676b403c7d

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 911
content-type: text/html
date: Wed, 28 May 2025 06:53:48 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.244

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 5173
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

136ms
135ms

Document
text/html

104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=1NNY&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Wed, 28 May 2025 06:53:50 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame C07E
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openxut&userId=17a18a6a-3700-439d-a38c-1437b9a26087&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHE7hmXyfVQF2a6Wf0&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=3a4ef222b0d3c171

43 B
496 B

130ms
129ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=3a4ef222b0d3c171
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=3a4ef222b0d3c171
Content-Length: 0
Date: Wed, 28 May 2025 06:53:55 GMT
Etag: 3a4ef222b0d3c171
Server: Adtelligent

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C07E
Redirect Chain

https://b1sync.zemanta.com/usersync/openx?puid=7701970b-dc27-4e7c-9e3a-97326d1e9eae&cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__
https://b1sync.outbrain.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&puid=7701970b-dc27-4e7c-9e3a-97326d1e9eae&s=2
https://b1sync.zemanta.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&obuid=490a6e54-9fd4-4b93-987b-6d7e6f1ce680&puid=7701970b-dc27-4e7c-9e3a-97...
https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680

43 B
61 B

115ms
115ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 112
date: Wed, 28 May 2025 06:53:51 GMT
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C07E
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=

43 B
61 B

104ms
104ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=
Content-Length: 131
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C07E
Redirect Chain

https://idpix.media6degrees.com/orbserv/hbpix?pixId=856286&pcv=125&ptid=23&tpuv=00&tpu=f06178c7-2f37-5ac8-3e20-40036bc30017
https://us-u.openx.net/w/1.0/sd?id=537072960&val=01vbbgfp48z4p

43 B
61 B

102ms
101ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072960&val=01vbbgfp48z4p
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072960&val=01vbbgfp48z4p
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 946bd6557b5b2efd-LAX
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
server: cloudflare

GET
H2 200 709996.gif
id.rlcdn.com/ Frame C07E 42 B
308 B 585ms
578ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 06:53:49 GMT
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame C07E
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=263d3b83-3cbe-42a1-a937-12421986eaff&ssp=openx&gdpr=&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10599362469613755998&ssp=openx&gdpr=&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10599362469613755998&ssp=openx&gdpr=&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=openx
https://x.bidswitch.net/sync?dsp_id=419&user_id=10599362469613755998&ssp=openx&gdpr=&gdpr_consent=
https://us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=

43 B
61 B

94ms
93ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:55 GMT
content-type: image/gif
vary: Accept

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:56 GMT

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame C07E 43 B
653 B 1327ms
140ms Image
image/gif 108.138.128.14
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=404e0d33-7863-446f-a34b-877acec8d2f3
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-14.jfk50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 c73892d3f4de40363aa07fd58a00ea50.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
x-amz-cf-pop: JFK50-P4
server: AAWebServer
x-amz-cf-id: WAUsqMHFWQBd16TW6zl4CKpd8b6GdsunIL1ZOZ8_3TnBfYjBXhq-xA==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 6FA9
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openx&userId=ae439c28-b8f4-4448-b603-49f4ffa9f4be&gdpr=&gdpr_consent=&us_privacy=1NNY
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=KvDdALZHLzDLw2KBSRuUVNu3&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=e31de355363501fe

43 B
496 B

154ms
149ms

Image
image/avif

137.184.136.136
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=e31de355363501fe
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Server: 137.184.136.136 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Wed, 28 May 2025 06:53:56 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=e31de355363501fe
Content-Length: 0
Date: Wed, 28 May 2025 06:53:56 GMT
Etag: e31de355363501fe
Server: Adtelligent

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6FA9
Redirect Chain

https://b1sync.zemanta.com/usersync/openx?puid=7701970b-dc27-4e7c-9e3a-97326d1e9eae&cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__
https://b1sync.outbrain.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&puid=7701970b-dc27-4e7c-9e3a-97326d1e9eae&s=2
https://b1sync.zemanta.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&obuid=490a6e54-9fd4-4b93-987b-6d7e6f1ce680&puid=7701970b-dc27-4e7c-9e3a-97...
https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680

43 B
61 B

106ms
105ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=560843120&val=490a6e54-9fd4-4b93-987b-6d7e6f1ce680
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 112
date: Wed, 28 May 2025 06:53:51 GMT
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6FA9
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=

43 B
61 B

97ms
96ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=HdhDQKUxXct0ey7No291gqL1zvQ&gdpr=&gdpr_consent=
Content-Length: 131
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6FA9
Redirect Chain

https://idpix.media6degrees.com/orbserv/hbpix?pixId=856286&pcv=125&ptid=23&tpuv=00&tpu=f06178c7-2f37-5ac8-3e20-40036bc30017
https://us-u.openx.net/w/1.0/sd?id=537072960&val=0ep3zv6meyvua

43 B
61 B

100ms
100ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072960&val=0ep3zv6meyvua
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072960&val=0ep3zv6meyvua
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 946bd657ddc92efd-LAX
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
server: cloudflare

GET
H3 200 709996.gif
id.rlcdn.com/ Frame 6FA9 42 B
60 B 608ms
127ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 6FA9
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=openx&bsw_custom_parameter=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=283&user_id=5dc90516-f3a1-40e8-883e-599dad13fe22&expires=1&user_group=2&ssp=openx&bsw_param=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&gdpr_pd=
https://us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=

43 B
61 B

93ms
91ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.244
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
vary: Accept

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //us-u.openx.net/w/1.0/sd?id=537072968&val=263d3b83-3cbe-42a1-a937-12421986eaff&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:53:51 GMT

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 6FA9 43 B
651 B 1380ms
155ms Image
image/gif 108.138.128.14
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=404e0d33-7863-446f-a34b-877acec8d2f3
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.14 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-14.jfk50.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 c73892d3f4de40363aa07fd58a00ea50.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
x-amz-cf-pop: JFK50-P4
server: AAWebServer
x-amz-cf-id: GbX1XGpSb6hBUQjjwM0YIjVl2wke7mKyl2jEb0NcAZn2hNv__bp7cQ==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/ Frame 9021 29 KB
11 KB 338ms
338ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250522/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIohPT5zQtSJxg80qfSLT28RK8nXhD1J8_Z5fJzHxJTs5ywK1e8KG8IKB4oRU3M0cE36t1euF1mSxKgiNwxnYph28OdVy1Td1DIZdYXSNb6RbSKGtk3KrsnLNQSWlrgdCeRLSKLYjBIp3UJTFdY8Ag-8hnhN2WQQD3G8hi81YNP5OhAlA7j6hSXTZ89qa7R9OdcfnikqH5u54XzkcMt2xpd540cDBkedCUAWaNTMZ8zXuHfaFDNuARK2ms2ZHdcjmtlS_Db37tnDp8LyalMSvj1bFW4w&dbm_d=AKAmf-CiDiZYfKNW6NbcXrJJmbVuEbkvhn1mhbbqP8IRix5gDn0f-kyOCCcTTni2jAXmBXZ0J3yhhlu8RpCa7p7OU9e07HiCYsmVBpPT0iAq-FTztFx3PL6XC1J0697f_--M4vm0GRCivB8XM6UNuPGOvTz2C_i_wV2KtfYiKS6uCLOJmzSg0RqQGtdixg2PAgJ7qCK8RXhyJroi1cU05SIIb_bLKSakdZr1_7EQPwdXanbfi46oYC0NlkAc2hefbahsqA9tYOL69-WyjXVdmOUW7MFdr6nl4CrRKGYe99urganD-gukIXOCkGrcXYw681CXkwu9dLgrisc5qvKFmKhSXR9gnomIJE6img2vi0edXd1M8-hIbP6wEkyahH5Ux6LJ-fBtOIS0qpr1-OMSv3XkUews2l71gx7Siwe4L40fBdUMjYk9ye2XfwyFyQOfwRcm619GxxBctIJusSZ9r5jWO3F4xByfgQyUTBa6eIaeUNpMcTLoq-Z179DumtVdGjOR91zVmyivZWrJJ3B2oyB_IlR_3gJ7O2_xekWVcKc9HUhFoDb3cXG5jxgVe5Q52rrSsCLOYG26CE-tPLed0-sRdYWl78sMfkoWjbeexZ8XirpFW7OsDndyDfmEm5Owe_qfVbQxyOVAWTzTKqUN5m73ZHxEwlsW-zY0Ek1Y6iYr74jyT9RWwKhCnhrSjNf7kA-gtSPT7TDEsdQGj-enUFTA3R7hRnAIsx1AZW994xXgWDtNMAlPeSMXhlm3i_QI9fOHhOUaM1pviHAkosPc86lLdJ1b1fZkSnnGU7jW-v9nDHeVByVKBVnsXZtCwKhAc7Hue-HyZyJUW813lS1zNmLX8lS_eFa7w_uLF6tk68grbF2KM7KptKP-xJxoMgVyL5cF0a2ZawzWudG1gP7WKxWK1oLFDgFTbb1_O1S19Vrqt9X5nBU1wfrlechMH-voo75S6lZhEI57vwkfzLbi-BG2JQUIVyms-x3UTeV58p9l-3P7gChl2FNzpULDPu8sxLnW6EAPkmh-iZCoH99rbBOP4mqnMW-K6gmd5WEGSD4ndHkaBfXUah0h_RUED3dmqPIG2WwfAXNJdBXEr7N9nCieK01pvtLNyWyX9tO7z_Bt8zXykRCQzup6AkZ_NHILKaKUQabEm1PkyWTgusRtCyc_GnY7xCHDa74h7nsQz2lCF8mHa_Z6Undiv3fjIOPzXImz7MUfA6iIeLpdkSjYGk_gKp4kLFMLsNOWeHlt0oK7wJ_iTtolJDwx3-4_GLhw0cGq2uddRsZv6IDtxh-GnKuoGG0Lsu1QoO0WSL0eK6pTiL7CGnqQoatjH1yJT6gN7u3X3Z14nItUB6rLgILgO2t858Fly_8KnGBahkJiuWGPyQ_7xbjvgd0YEQP9LyXcgLxLRnK6bdrEQxsTxubTk7wI-sf67ziKmpikqXze1eAAEPjBh_3FjD1h6BLN4035O1BmrvLso-twF0m-VxibLU-Cv4mehJbrf4a5z5Qn2HfcRKHsjDNh19-v2Z6z9FHrikvfryGM-uDQVMEl0CAurl3iWMK8d4ynzQXw8cdHpU6RP1jtdOrcbO1Bh3IZFavpveBSo40c43s3HDgGEzFiCyDghDlNDlJ1A2Vktvr0wk4qQF4vz58lRp4Il44VUjFeOiHR1ExpCXkapgwPkouexwVRsJLAl6Cz5LNCtjo4UooxNqZMOTaJJTi836XOQotOZj_rDf7DNZMX9bveh6HK-sdimXzkESwOOLnh9iXgvXJz5SvitliVEGbWC4J-x9y-lAUYdRxr_XQAxYi1sifz4FhxHte5P-nsZM-723VUQGdOd1HZ5PHgiDRjJ8MJXFn-iGDFtbOYNAXJQKta72Te7KTN9QORiRMDKuGioo2d2tyRtFbY3vFAOu-ID2TZRVS94xsDeLUz1zxCtjcrpXEoObt3tGjrbSTkruSuGh6-RAlzrSlC6DVLrqbqs5lIGDvOteWnHzVYbpPh7GSh1wbd_CEUNyyuOZUCDo1THEd6eullZhbacRbhEfjLaSxS9bPHrup-H4NN4hUjznN9AxW_JI0M0MYd69FCY5gDpCmZ5jw0EgLf-qZGzQOojE4kfdY3aaaml0JM6smS2XxURk0MFz08kva7pOADsmSjuHX0hGWWD93DGReq8dkN5wbgtJWruhIsZ1peDxjM18GFHnL-cvhKhBo_gDt94iAlKV3TezS0_wlXTVrBxaLkNIzxzxlbJl9jvKOgIW9QaK0bmDHthHkUIZm4zrOP0-ANpE55BTgB51dBy8CxZHz47hjAwaB4RSdFDXFtGz5_nFwj-OEI23PGTa_8hgBNEdalAZZrQrvmwIiBPjtGgZjI6DH_zZKOOXLaTs_KD28550sjgp7EYgpm4banOaydAX5ff7TzaYBqK9d7G6t2Nakw330zOUvzW1ObjRoj9hDqD-Ds7JU8au7omrpG8axMJiPwaNxO9oGZVx-Ca-nVujWZUVhXQ1B9nwgLyk9fjj9qc5WJRdSSXBWr_htkDzACmf6h_pW4kAK3ezZRqyMO3PPTBxquveYQ9erYwQ4vVog7yjoze_EKFpVI65GHpEoiDLPwhPNxGoSzBBa3uskek4Hh8MvKA_mHoN4sVySnvSbTb-BLtI5tiYd18MP_NHKtnbFzyFmsNQD9fybYAQup75pT33x_LSalAxFWtGeAbyZtMrze3jn3ze8ehsVPIPrstkBHUk-UphTJ4qV0G8URjInXcM3-ppfqS8n7aZTIWfYV4lFEjLIi-40IN-ZLWcG1Wg7z63bm70_RwbDDkIw8LBIfTnUvJWMu5k7dYWOXhx-Ts0MtYPPGNu5qxud1xnsXknSY27ph8Lr3yau78-qkMiDvioX-L1v0N082W_bO5eNU5mej8hn9Skvk6k0U2NyOpIF3SOG3vk7wG0y5K4VJ3VXyKQVPHhlFgPJmM-S61JRiYp3MjKo6a0gTgclXHilqY-PoqpwwQkt-e3iukfKLg0FfC-6SVL8zNoyL5ZT5x_8QYSy0RkRU4n1DgEEPFUKyYZ64ScH3szrSjkbjkHLonAysiwrOMtsJZLKUcaFHtwO81RLUTThouLHRF86kZwfUm-gDRgAP3BTZvz1dZuf228t-7XT4pM3Fnh6iqMgRkOfsohCVy7CnjCjdHFDg4Z_2Rginm3yvP7dNjoHmjynaWwstY3qL96C5HwfnN7TXKkisW4BYftB2UmMNntO5mNposdoNWQ3X7trzub8pEoaUvL5eVF8WNzCQ9zsigl7pnIVRvD73iluik_Mh_QYju7XRJuNMl7a08oHW4jgp9b7YBcb09ZG33D3rTlPXnojABhC-bqnv_27InBKp9L0JNmMnuQ_yPX6XVQrl70RnmUKAvVnDRA5v5wQOcotKhcf-S0uMblA4TEqmjs75mNvkM9BmtZS5axtbESEOryHvpSNJfqMpRQS3W-CBsNAdoBeSbkll61xmde4pSKD6qG5lWKKZjsdlK-stYqJX1afDcUlaNaalOauEPnzH5QFClJu5VeXW9iP0Sqa7Me-8ipENZAY0UPgUuLiyEg6dvxpsqylY9D1SfmKhTcIt6fkAG-dWSQaiWqrB41ObySGoSndOcpM66wVETHb4cDfWaGHC6Fc3SXuxmpeJK_Ct1jUi6uPXyYonlwEbTHqHMAvH141BpqP-VD6tF4z3VTqvb1lft-fZFSD2jqYKGCPEK5pKJW15dbuopi4i8ntvaqJE55iyCKm1Zrw5C-pWeC5ENo7JzlZv8lgvTPJ5BDE8_4vjTkCCFO8hgra26X_EXH4QbKbhG90lbXyVaTeN9uInlZhchmS1gYbIp_otgXnqf-7SuM157ZdZyzla6DQrKi1rOHXZIJSlBzqzTlrQTVDrf_w61g7fwxnynv2iUGzui_hAixepD6v3fiGeE21Hh4jnUEyCVwTryqRJ4FXdlKngEMt3H10-PxMwYarkUb5bFru-Osa8CoVeaa_KLU1AhETvRVS6MnCa2EsV7sWDi6mNMTvb54DvAjWniBUN7ApdKnQ3Qx9eHYHdkkHDFnkzAifM9G78a8cpBI_8Ncu1RTs8RWO5pPZZhw-Diqg2jakrkqxHALY1djC8nZJcv4qu4AJjJDqN6G7nWt2ljakhaEjzRalGwb2ZaSRWsX2un1ti4d0aBdRRMa75xMIHCgQRa4v4ft-G17ZryRqOAbavnm3kwAJLxYOnf5eInDxB_M-1DY3fJwbXcTuytXnabS2GeI1zGp9G4oQ_sNT6rOyhYOanKMKpFbtHtDj51Vpd3fPiDQ5cJQkxBgzTeJ1nMW6J1qTQF-18qgNgPF7YeFmM4asiwiE-h0o0jFmoA2wF9wNxDF8KhYnnhqVxZMNWiqE_AlaY11Hm_3Ya-Q1MTGulYPWNW3jJ4AZIJfenipnz5p7iHP_2X7QjygA5Y8USfbNvdCdUQLu8yRGav9Vk67dbp8S2Fp6v1vFxBVBmKKLwc2ZieNsSSFtXFsSuzlazQLLpj-9CrYQILZDFQgBGrrVrJxPhRqOJQYPJ56t_wVv3d4eIdQ_oXS58xgb-4kXAeEOWulC9gvPPIYyKZOuIxE4pHBuzmpLyjiwtEMJTjSSNz875yXQ9YLi8umtk0WfY_TV07M2FjThNtFrLVAEG-loJLI2r6vWmKS8PnGGR2K2JwgtAm66-SB0HJHi6Fx1vlVJ98O0U-bENRs2jIjt-LxBOE0D6ukbNqsFGTSacmR03ocHS2fMEzq5WSB9ObzCProb2cYC5E6k2_jdp_ce3a0ME3wct9WiZWOR7acGahcYOAacskQ34Zt2IMu7H9Ls0MrVnsbMfYgA2djVslnWzS7poty-kuEukzX2j9dyOv13n2ne5WkhttQfUD0XwiDXMbvKamLB8SMVy4rHVNXs9PiRRLUxBnW1e_l506hQDSmxN8S4IoI2jPQaDl_Le&cid=CAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB&dv3_ver=m202505060201&nel=1&rfl=https%3A%2F%2Fpaint.toys%2F&ds=l&xdt=1&ct=77&iif=1&cor=6996404437487368000&adk=4188270524&idt=870&cac=0&dtd=56

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-18-238-80-73.jfk52.r.cloudfront.net

Software

cafe /

Resource Hash

2e4ab2fd00ce810ecb40c329fc74eabf3131ebb8adddf2cf44e6ce2357180136

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 13617926490653145715
age: 53127
x-content-type-options: nosniff
expires: Tue, 10 Jun 2025 16:08:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Tue, 27 May 2025 16:08:22 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10882
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9021 41 KB
14 KB 439ms
148ms Script
text/javascript 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 477
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 28 May 2025 07:35:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 06:45:53 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H/1.1

200
OK

view
tpt.mediaplex.com/event/etc/ Frame 9021
Redirect Chain

https://tpt.dotomi.com/event/etc/view?vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=602452689&audience=&client_campaign_id=32613768&creative_id=226940...
https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=6...

43 B
394 B

626ms
325ms

Image
image/gif

2606:ae80:1471:15::410
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=602452689&audience=&client_campaign_id=32613768&creative_id=226940197&placement_id=410551860&s_id=8617651&site_name=N834879.4729871ADSWERVE-MATTRESS&cachebuster=4113769425%22style=%22width:1px;height:1px;display:none;
Requested by: Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: HTTP/1.1
Server: 2606:ae80:1471:15::410 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

Cache-Control: no-cache, private, max-age=0, no-store
Pragma: no-cache
Connection: keep-alive
Expires: 0
Content-Length: 43
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: image/gif
Server: nginx

Redirect headers

cache-control: no-cache, private, max-age=0, no-store
location: https://tpt.mediaplex.com/event/etc/view?dtm_user_tkn=AQAHxxq_ulwBKQJFUZqaAQEBAQEBAQCWFKowLQEBAJYUqjAt&vndr_id=2096&vndr_name=DCM&comp_id=83764&campaign_id=101371&dvc_id=&ggl_play_id=&idfa=&ad_id=602452689&audience=&client_campaign_id=32613768&creative_id=226940197&placement_id=410551860&s_id=8617651&site_name=N834879.4729871ADSWERVE-MATTRESS&cachebuster=4113769425%22style=%22width:1px;height:1px;display:none;
pragma: no-cache
expires: 0
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
content-type: image/gif
server: nginx

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0ODQxNTIyOTQyMTM2MQogIHNlcnZlcl9pcDogMTQxMDM3MTk2CiAgcHJvY2Vzc19pZDogMTI5NTMwMzgxNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA4NDI1MTAw...
ad.doubleclick.net/ddm/activity/ Frame 9021 0
988 B 877ms
304ms Image
image/png 142.250.65.230
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0ODQxNTIyOTQyMTM2MQogIHNlcnZlcl9pcDogMTQxMDM3MTk2CiAgcHJvY2Vzc19pZDogMTI5NTMwMzgxNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiA4NDI1MTAwCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9tYXR0cmVzc2Zpcm0uY29tIgp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDE1CmV2ZW50X2ltcHJlc3Npb25faWQ6IDQ4MTgzNDU0MDUzNzMxMDQxMDcKZGVidWdfa2V5OiA3NTg4MzgyNTgxMjczMDkxNTg4CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyNS0wNS0yOCIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg0MjUxMDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX01PQklMRV9CUk9XU0VSX0NMQVNTCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDEwNTUxODYwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPT0tJRV9DT05TRU5UCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTQ3MDUwOTA1CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIxOTk1Mjc1ODI4CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNjE4NDEzMzM5CiAgfQp9CmFyY2hldHlwZV9pZDogNjUyOTM1NDI0CmFyY2hldHlwZV9pZDogNjUyOTM1NDI1CmFyY2hldHlwZV9pZDogNjUyOTM1NDI2CmFyY2hldHlwZV9pZDogNjUyOTM1NDI3CmZsb29kbGlnaHRfYWN0aXZpdGllc19mb3JfYmlkZGluZzogNzA2Mjc1MApmbG9vZGxpZ2h0X2FjdGl2aXRpZXNfZm9yX2JpZGRpbmc6IDcxNjkzNjQKZmxvb2RsaWdodF9hY3Rpdml0aWVzX2Zvcl9iaWRkaW5nOiA4MjU4MjU3CmZsb29kbGlnaHRfYWN0aXZpdGllc19mb3JfYmlkZGluZzogMTIxNjc4OTYKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL21hdHRyZXNzZmlybS5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3ODA0NzYwODgzMgpkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3CnhmYV9hdHRyaWJ1dGlvbl9hcGlfdHlwZTogWEZBX0FUVFJJQlVUSU9OX0FQSV9UWVBFX1dFQgplY2hvX3NlcnZlcl9hY3Rpb246IEVDSE9fU0VSVkVSX0FDVElPTl9VU0VfQkVTVF9BVkFJTEFCTEVfQVJBCmV2ZW50X3JlcG9ydGluZ193aW5kb3dzIHsKICBlbmRfdGltZXNfc2Vjb25kczogODY0MDAKICBlbmRfdGltZXNfc2Vjb25kczogMzQ1NjAwCn0KbWF4X2V2ZW50X2xldmVsX3JlcG9ydHM6IDIKZmxvb2RsaWdodF9hcmFfY29uZmlncyB7CiAgYXJjaGV0eXBlc19jb25maWcgewogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2NTI5MzU0MjQKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDIyCiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAzCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDEKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuMDEKICAgIH0KICAgIGFnZ3JlZ2F0ZV9rZXlfYXJjaGV0eXBlcyB7CiAgICAgIGFyY2hldHlwZV9pZDogNjUyOTM1NDI1CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMwogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMwogICAgICBjb252X21ldHJpY190eXBlOiBNRVRSSUNfVFlQRV9DT1VOVAogICAgICBhZ2dyZWdhdGVfa2V5X2xldmVsOiAyCiAgICAgIGNvbnRyaWJ1dGlvbl9wZXJjZW50YWdlOiAwLjAxCiAgICB9CiAgICBhZ2dyZWdhdGVfa2V5X2FyY2hldHlwZXMgewogICAgICBhcmNoZXR5cGVfaWQ6IDY1MjkzNTQyNgogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjQKICAgICAgY29udmVyc2lvbl9hcmNoZXR5cGVfaWQ6IDMKICAgICAgY29udl9tZXRyaWNfdHlwZTogTUVUUklDX1RZUEVfQ09VTlQKICAgICAgYWdncmVnYXRlX2tleV9sZXZlbDogMwogICAgICBjb250cmlidXRpb25fcGVyY2VudGFnZTogMC4wMQogICAgfQogICAgYWdncmVnYXRlX2tleV9hcmNoZXR5cGVzIHsKICAgICAgYXJjaGV0eXBlX2lkOiA2NTI5MzU0MjcKICAgICAgaW1wcmVzc2lvbl9hcmNoZXR5cGVfaWQ6IDI1CiAgICAgIGNvbnZlcnNpb25fYXJjaGV0eXBlX2lkOiAzCiAgICAgIGNvbnZfbWV0cmljX3R5cGU6IE1FVFJJQ19UWVBFX0NPVU5UCiAgICAgIGFnZ3JlZ2F0ZV9rZXlfbGV2ZWw6IDQKICAgICAgY29udHJpYnV0aW9uX3BlcmNlbnRhZ2U6IDAuOTcKICAgIH0KICAgIGltcHJlc3Npb25fYXJjaGV0eXBlcyB7CiAgICAgIGltcHJlc3Npb25fYXJjaGV0eXBlX2lkOiAyMgogICAgICBbYWRzLnJlZ2lzdHJhdGlvbl9saWIuQ29tbW9uSW1wcmVzc2lvbkFyY2hldHlwZS5pbXByZXNzaW9uX2FyY2hldHlwZV0gewogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT09LSUVfQ09OU0VOVAogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjMKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjQKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogICAgICB9CiAgICB9CiAgICBpbXByZXNzaW9uX2FyY2hldHlwZXMgewogICAgICBpbXByZXNzaW9uX2FyY2hldHlwZV9pZDogMjUKICAgICAgW2Fkcy5yZWdpc3RyYXRpb25fbGliLkNvbW1vbkltcHJlc3Npb25BcmNoZXR5cGUuaW1wcmVzc2lvbl9hcmNoZXR5cGVdIHsKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICAgICAgICBpbXByZXNzaW9uX2F0dHJpYnV0ZXM6IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9NT0JJTEVfQlJPV1NFUl9DTEFTUwogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogICAgICAgIGltcHJlc3Npb25fYXR0cmlidXRlczogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgICAgICAgaW1wcmVzc2lvbl9hdHRyaWJ1dGVzOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9BVVRPX1RBUkdFVElORwogICAgICB9CiAgICB9CiAgICBjb252ZXJzaW9uX2FyY2hldHlwZXMgewogICAgICBjb252ZXJzaW9uX2FyY2hldHlwZV9pZDogMwogICAgICBbYWRzLnJlZ2lzdHJhdGlvbl9saWIuQ29tbW9uQ29udmVyc2lvbkFyY2hldHlwZS5jb252ZXJzaW9uX2FyY2hldHlwZV0gewogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fQ09OVkVSU0lPTl9EQVRFCiAgICAgICAgY29udmVyc2lvbl9hdHRyaWJ1dGVzOiBDT05WRVJTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0FDVElWSVRZX0lECiAgICAgICAgY29udmVyc2lvbl9hdHRyaWJ1dGVzOiBDT05WRVJTSU9OX0RJTUVOU0lPTl9JU19CSUREQUJMRQogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fRFVQTElDQVRFX1JFQVNPTgogICAgICAgIGNvbnZlcnNpb25fYXR0cmlidXRlczogQ09OVkVSU0lPTl9ESU1FTlNJT05fQUdHX1ZBTFVFX0JVQ0tFVAogICAgICB9CiAgICB9CiAgICBtYXhfYXR0cmlidXRpb25zX3Blcl9pbXByZXNzaW9uOiAyMAogIH0KICBzdGFydF9kYXRlOiAyMDI1MDUyOAogIGNvbmZpZ19zdGF0dXM6IFNUQVRVU19PSwp9Cg

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.230 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"652935424":"0x474be4cd3a16cc650000000000000000","652935425":"0xe8b8cf1301cbada0000000000000000","652935426":"0x427cbef1188676aa0000000000000000"},"debug_key":"7588382581273091588","debug_reporting":true,"destination":["https://mattressfirm.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["7062750","7169364","8258257","12167896"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["8425100"]},"max_event_level_reports":2,"priority":"0","source_event_id":"4818345405373104107"}
content-type: image/png
server: cafe

GET
H2 200 player Show response
realtime.clinch.co/video/player_v1/ Frame E03A 11 KB
12 KB 632ms
286ms Document
text/html 18.238.80.73
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://realtime.clinch.co/video/player_v1/player?cid=pfzb1W&caid=63847&format=_160ax600a&dsp=dv360&plcId=21995275828&plc=1348273&dsp_impression_id=ABAjH0je9dT_JlHYjp9O-bw5OIdE&dsp_c0=21995275828&site_url=https://paint.toys/oil/&dsp_pub_id=1&site_id=1995081996404&dsp_insertion_order_id=1018126635&dsp_caid=21995275828&dsp_crid=618413339&dsp_tracker_token=AOjeLNEAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQItIyV-FGoApm3-qIEsAKrwr3lA0AB0gIqGAAiEwj7m6ikysWNAxVcpFoFHSdyKWIoATABOPvciZi2E0ACSAFYiIEgEJv68KYCDRdlchQ27KHeB0Fe17xoMQ&rnd=1748415227235835&gdpr=0&gdpr_consent=&gdpr_pd=&env=web&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCSarW-7I2aLuyDtzI6toPp-SlkQam9tD6e_vciZi2E-3r3uHoRBABIPub1UlgyZ72hoCAoBmgAdKG75opyAEJqAMByAObBKoE5AFP0IEUejxABQGNTt2Aro-WgDhKbwFaugOSGYn8-isZ14pm41NcS9ssk8SfJWGi3CS4qYnFd2IWv_UTIVsFD3LOaxrEQYcNAa1S3WJffg1KjnRlPZdtWCC-f3l06QGjI_XYtcGqPGEmavc_Q1Y0fnj_TDqfJsjEQAdpIxY4nR6RTbLjyQyoLpmT1fbhzVxQxTNcyav3tLE4C6TDNZaV9zbKZ42X9OQ8mTNKDJL6glJaaVfU7GSSA7fIFNhVebrhancwH3Rc7Y9Mkp_KNa_YP-kw4YBwev_kgsVROae3sQtyI-bXBtXABJbx1sD1BOAEA4gFtIyV-FGQBgGgBk2AB9K-v_oDqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnQEyAooCOg2AQIDAgICAgKiAAqADSL39wTpY_cCmpMrFjQOACgOYCwHICwGADAGqDQJVU-INEwjd86akysWNAxVcpFoFHSdyKWLqDRMIx8SnpMrFjQMVXKRaBR0ncili8A0BsBOf1OQcyBOrwr3lA9gTCtgUAdAVAfgWAYAXAbIXowEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAw6BcFshgJEgLMZxhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB%26sig%3DAOD64_0Tw2qGvf9aRlIGRKclxga4Xn03YQ%26client%3Dca-pub-5812357352335075%26dbm_c%3DAKAmf-CMEZumeFzo5htbjl_Si5kUKoEpAl_uAkge-ocT-1uOoJ3yDVONl_lnVxaia8PEpEtta3E1tzrWib7AujrVZHg24L8gef0HkaPjewq12Cnpd-kD2RxHbVh5A9V-bBizx6FU-DJ1QExHcc1EwiZj04wW_hLtBMSDbrifoS_D4eRUOs9mCA-E0-Wn2Yew1cAUMpl0_K1W9ntkAm_vGtWLl-EDE04moiEQEJTFxLnnLpJQTYJppWwxOZz4QcPRF2hzovwrlr8rOg2ysPY801E3ylZG1JMwbw%26dbm_d%3DAKAmf-B4lG4UWlV9fvCb4fvuKWQqqZuNnulYciR7zm3SpjJlquyOPK-YW5_BkWlL7fSz1MwZlfVIuOhnSH-qA4xJDnp_LI8TC2e_VGaURrHBjX9Ab4fHdBWU4tW-eOFCdTnkBLXFhPWKokKb2GCJ7roUmoPY7taTheW24EsHfITcPdrkdiolG7zgyJD6_heQJqnFhBlN49rjSgrNJaJWhHci8nyuuxsPJh9wz9JQUIlHJY6BVq-Ig3nZyH-oGSDza-0bICClR60sM8O2N8U-oKumWJ0QztiBCMbCfBPAAJnMugwYAA5_DY7vNgSq_SrVt64MgTpDuLrkWs2Sk7Hkfvm0ce38FJJ6PUdshHINb3Gow-nYYnVcsa1tjTrgrpYYlaZqlVIqirqO4eS4h4GSyW3Pqu5KfUwcaY96CfRBy-se_w-YJTJSGlvm5VE-pRaNHcxUUngUHVYRCxSGzpj9IJpf9Brltg-fHatwfAJI0VD8jms8sGfQCPJdyFDRb3pc4vh0qgoUWzzR-bbQ_UcPrCMPTo06IEJUzT9vumN6TyDpuWrdVhWQ9om-oQ0PZKuG53OMWOOdsSDaUxUnHiAgVMN0_qgjUCaJfdsWDtqXLn385hFbR1YlUvEpgtr2ipi_2fNvb4LtvuVtG8_iGNtdPRVppaBgCesYp-0Csa_c86E-UO45ff9lCq4%26adurl%3D

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.238.80.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

5f9b229a0be8ecc4ccacf013c8d4aed57d33259252d13bad9c65bbfed586e07e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store
content-type: text/html; charset=utf-8
date: Wed, 28 May 2025 06:53:50 GMT
server: clinch
strict-transport-security: max-age=31536000
via: 1.1 b67b60901a678f2f5872beaa2033c562.cloudfront.net (CloudFront)
x-amz-cf-id: BL6fnVFWl2uKjC7VKp0H1uUAC8vSWgCqHoYcpHk3K4MDv6QURLYQqw==
x-amz-cf-pop: JFK52-P5
x-cache: Miss from cloudfront

GET
DATA 200
OK truncated
/ Frame 68D0 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 68D0 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 9C61 0
797 B 168ms
167ms Script
text/html 68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.244; 162.245.206.244; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 2b0d4e2b-fb3b-4920-bc44-ebc0bdebe7bb
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Wed, 28 May 2025 06:53:50 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 0
0 162ms
160ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 0
0 151ms
150ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 9021 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b0f9ba927defb85e879ed382933687736e983cc498d10a98fec47f8af60164a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9021 0
0 151ms
151ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-211-170-34.compute-1.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 1553ms
267ms Image
text/plain 54.211.170.34
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.211.170.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 74F5 38 KB
13 KB 291ms
289ms Document
text/html 2607:f8b0:4006:81c::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1887
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 06:22:23 GMT
expires: Wed, 28 May 2025 07:12:23 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runtime_10_25.5.23.1.min.js Show response
cdn.clinch.co/a_js/dispad/ Frame E03A 110 KB
35 KB 309ms
306ms Script
text/javascript 2600:9000:261f:2c00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.clinch.co/a_js/dispad/runtime_10_25.5.23.1.min.js

Requested by

Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=pfzb1W&caid=63847&format=_160ax600a&dsp=dv360&plcId=21995275828&plc=1348273&dsp_impression_id=ABAjH0je9dT_JlHYjp9O-bw5OIdE&dsp_c0=21995275828&site_url=https://paint.toys/oil/&dsp_pub_id=1&site_id=1995081996404&dsp_insertion_order_id=1018126635&dsp_caid=21995275828&dsp_crid=618413339&dsp_tracker_token=AOjeLNEAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQItIyV-FGoApm3-qIEsAKrwr3lA0AB0gIqGAAiEwj7m6ikysWNAxVcpFoFHSdyKWIoATABOPvciZi2E0ACSAFYiIEgEJv68KYCDRdlchQ27KHeB0Fe17xoMQ&rnd=1748415227235835&gdpr=0&gdpr_consent=&gdpr_pd=&env=web&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCSarW-7I2aLuyDtzI6toPp-SlkQam9tD6e_vciZi2E-3r3uHoRBABIPub1UlgyZ72hoCAoBmgAdKG75opyAEJqAMByAObBKoE5AFP0IEUejxABQGNTt2Aro-WgDhKbwFaugOSGYn8-isZ14pm41NcS9ssk8SfJWGi3CS4qYnFd2IWv_UTIVsFD3LOaxrEQYcNAa1S3WJffg1KjnRlPZdtWCC-f3l06QGjI_XYtcGqPGEmavc_Q1Y0fnj_TDqfJsjEQAdpIxY4nR6RTbLjyQyoLpmT1fbhzVxQxTNcyav3tLE4C6TDNZaV9zbKZ42X9OQ8mTNKDJL6glJaaVfU7GSSA7fIFNhVebrhancwH3Rc7Y9Mkp_KNa_YP-kw4YBwev_kgsVROae3sQtyI-bXBtXABJbx1sD1BOAEA4gFtIyV-FGQBgGgBk2AB9K-v_oDqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnQEyAooCOg2AQIDAgICAgKiAAqADSL39wTpY_cCmpMrFjQOACgOYCwHICwGADAGqDQJVU-INEwjd86akysWNAxVcpFoFHSdyKWLqDRMIx8SnpMrFjQMVXKRaBR0ncili8A0BsBOf1OQcyBOrwr3lA9gTCtgUAdAVAfgWAYAXAbIXowEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAw6BcFshgJEgLMZxhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB%26sig%3DAOD64_0Tw2qGvf9aRlIGRKclxga4Xn03YQ%26client%3Dca-pub-5812357352335075%26dbm_c%3DAKAmf-CMEZumeFzo5htbjl_Si5kUKoEpAl_uAkge-ocT-1uOoJ3yDVONl_lnVxaia8PEpEtta3E1tzrWib7AujrVZHg24L8gef0HkaPjewq12Cnpd-kD2RxHbVh5A9V-bBizx6FU-DJ1QExHcc1EwiZj04wW_hLtBMSDbrifoS_D4eRUOs9mCA-E0-Wn2Yew1cAUMpl0_K1W9ntkAm_vGtWLl-EDE04moiEQEJTFxLnnLpJQTYJppWwxOZz4QcPRF2hzovwrlr8rOg2ysPY801E3ylZG1JMwbw%26dbm_d%3DAKAmf-B4lG4UWlV9fvCb4fvuKWQqqZuNnulYciR7zm3SpjJlquyOPK-YW5_BkWlL7fSz1MwZlfVIuOhnSH-qA4xJDnp_LI8TC2e_VGaURrHBjX9Ab4fHdBWU4tW-eOFCdTnkBLXFhPWKokKb2GCJ7roUmoPY7taTheW24EsHfITcPdrkdiolG7zgyJD6_heQJqnFhBlN49rjSgrNJaJWhHci8nyuuxsPJh9wz9JQUIlHJY6BVq-Ig3nZyH-oGSDza-0bICClR60sM8O2N8U-oKumWJ0QztiBCMbCfBPAAJnMugwYAA5_DY7vNgSq_SrVt64MgTpDuLrkWs2Sk7Hkfvm0ce38FJJ6PUdshHINb3Gow-nYYnVcsa1tjTrgrpYYlaZqlVIqirqO4eS4h4GSyW3Pqu5KfUwcaY96CfRBy-se_w-YJTJSGlvm5VE-pRaNHcxUUngUHVYRCxSGzpj9IJpf9Brltg-fHatwfAJI0VD8jms8sGfQCPJdyFDRb3pc4vh0qgoUWzzR-bbQ_UcPrCMPTo06IEJUzT9vumN6TyDpuWrdVhWQ9om-oQ0PZKuG53OMWOOdsSDaUxUnHiAgVMN0_qgjUCaJfdsWDtqXLn385hFbR1YlUvEpgtr2ipi_2fNvb4LtvuVtG8_iGNtdPRVppaBgCesYp-0Csa_c86E-UO45ff9lCq4%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:2c00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

dd3404bebbc0665dac3555a7db8e62fdda7e38d29fa0167509688c31b8d02b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

content-encoding: br
etag: W/"7a118c08ab58c3e4cb2fc37be7b06357"
age: 167793
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Ij3HCdH_WGDmhO9L4p6UpbkyBb4w0wHj3gPLtoTGeTuT_NdQ1ShL2A==
date: Mon, 26 May 2025 08:17:18 GMT
content-type: text/javascript
vary: accept-encoding, Origin
last-modified: Mon, 26 May 2025 08:16:35 GMT
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
via: 1.1 d2b8f634cf8ac5ec77dee366297223bc.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 160ax600_v15_u765278557_en_movie.js Show response
cdn.clinch.co/a_styles/18685/js/ Frame E03A 49 KB
20 KB 454ms
453ms Script
text/javascript 2600:9000:261f:2c00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.clinch.co/a_styles/18685/js/160ax600_v15_u765278557_en_movie.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:2c00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

6fe176fd810776d8b62cfefa2cbca93cedc41bd8ed3f5aa9a4e98385ff326104

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

content-encoding: gzip
etag: W/"99f53e4eb706ee8525d23920fe37dbcf"
age: 2547634
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: OXPZWaIxOR10HIYHCoUhyN_s8jUqr2y-Dzt_Un0QJlcYVuXNiDEy4g==
date: Mon, 28 Apr 2025 19:13:17 GMT
content-type: text/javascript
vary: accept-encoding, Origin
last-modified: Tue, 19 Nov 2024 16:23:10 GMT
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
via: 1.1 d2b8f634cf8ac5ec77dee366297223bc.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 160ax600_v15_u91987203_169240525_mapping.js Show response
cdn.clinch.co/a_styles/18685/js/ Frame E03A 5 KB
1 KB 455ms
454ms Script
text/javascript 2600:9000:261f:2c00:12:6a04:c9c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://cdn.clinch.co/a_styles/18685/js/160ax600_v15_u91987203_169240525_mapping.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:2c00:12:6a04:c9c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

dd5547470e7085edead912e4a915f9cbebff8a7411e56ba94b8b45e9722a0e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

content-encoding: gzip
etag: W/"6e527974a8ac995debea1c72054d6a78"
age: 2547634
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: mY4bWkygJC2QgaH32mTmDxQfsYqzQ9XucMOIz3yOVX1_USKFh9hsQQ==
date: Mon, 28 Apr 2025 19:13:17 GMT
content-type: text/javascript
vary: accept-encoding, Origin
last-modified: Mon, 18 Nov 2024 23:25:56 GMT
strict-transport-security: max-age=31536000
cache-control: max-age=2592000
via: 1.1 d2b8f634cf8ac5ec77dee366297223bc.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame E03A 9 KB
4 KB 453ms
138ms Script
text/javascript 2600:141b:1c00:44::17db:2444
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=28328433&cmp=32613768&sid=8617651&plc=410551860&adsrv=199&btreg=&btadsrv=&crt=160x600&tagtype=&dvtagver=6.1.src
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=pfzb1W&caid=63847&format=_160ax600a&dsp=dv360&plcId=21995275828&plc=1348273&dsp_impression_id=ABAjH0je9dT_JlHYjp9O-bw5OIdE&dsp_c0=21995275828&site_url=https://paint.toys/oil/&dsp_pub_id=1&site_id=1995081996404&dsp_insertion_order_id=1018126635&dsp_caid=21995275828&dsp_crid=618413339&dsp_tracker_token=AOjeLNEAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQItIyV-FGoApm3-qIEsAKrwr3lA0AB0gIqGAAiEwj7m6ikysWNAxVcpFoFHSdyKWIoATABOPvciZi2E0ACSAFYiIEgEJv68KYCDRdlchQ27KHeB0Fe17xoMQ&rnd=1748415227235835&gdpr=0&gdpr_consent=&gdpr_pd=&env=web&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCSarW-7I2aLuyDtzI6toPp-SlkQam9tD6e_vciZi2E-3r3uHoRBABIPub1UlgyZ72hoCAoBmgAdKG75opyAEJqAMByAObBKoE5AFP0IEUejxABQGNTt2Aro-WgDhKbwFaugOSGYn8-isZ14pm41NcS9ssk8SfJWGi3CS4qYnFd2IWv_UTIVsFD3LOaxrEQYcNAa1S3WJffg1KjnRlPZdtWCC-f3l06QGjI_XYtcGqPGEmavc_Q1Y0fnj_TDqfJsjEQAdpIxY4nR6RTbLjyQyoLpmT1fbhzVxQxTNcyav3tLE4C6TDNZaV9zbKZ42X9OQ8mTNKDJL6glJaaVfU7GSSA7fIFNhVebrhancwH3Rc7Y9Mkp_KNa_YP-kw4YBwev_kgsVROae3sQtyI-bXBtXABJbx1sD1BOAEA4gFtIyV-FGQBgGgBk2AB9K-v_oDqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnQEyAooCOg2AQIDAgICAgKiAAqADSL39wTpY_cCmpMrFjQOACgOYCwHICwGADAGqDQJVU-INEwjd86akysWNAxVcpFoFHSdyKWLqDRMIx8SnpMrFjQMVXKRaBR0ncili8A0BsBOf1OQcyBOrwr3lA9gTCtgUAdAVAfgWAYAXAbIXowEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAw6BcFshgJEgLMZxhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB%26sig%3DAOD64_0Tw2qGvf9aRlIGRKclxga4Xn03YQ%26client%3Dca-pub-5812357352335075%26dbm_c%3DAKAmf-CMEZumeFzo5htbjl_Si5kUKoEpAl_uAkge-ocT-1uOoJ3yDVONl_lnVxaia8PEpEtta3E1tzrWib7AujrVZHg24L8gef0HkaPjewq12Cnpd-kD2RxHbVh5A9V-bBizx6FU-DJ1QExHcc1EwiZj04wW_hLtBMSDbrifoS_D4eRUOs9mCA-E0-Wn2Yew1cAUMpl0_K1W9ntkAm_vGtWLl-EDE04moiEQEJTFxLnnLpJQTYJppWwxOZz4QcPRF2hzovwrlr8rOg2ysPY801E3ylZG1JMwbw%26dbm_d%3DAKAmf-B4lG4UWlV9fvCb4fvuKWQqqZuNnulYciR7zm3SpjJlquyOPK-YW5_BkWlL7fSz1MwZlfVIuOhnSH-qA4xJDnp_LI8TC2e_VGaURrHBjX9Ab4fHdBWU4tW-eOFCdTnkBLXFhPWKokKb2GCJ7roUmoPY7taTheW24EsHfITcPdrkdiolG7zgyJD6_heQJqnFhBlN49rjSgrNJaJWhHci8nyuuxsPJh9wz9JQUIlHJY6BVq-Ig3nZyH-oGSDza-0bICClR60sM8O2N8U-oKumWJ0QztiBCMbCfBPAAJnMugwYAA5_DY7vNgSq_SrVt64MgTpDuLrkWs2Sk7Hkfvm0ce38FJJ6PUdshHINb3Gow-nYYnVcsa1tjTrgrpYYlaZqlVIqirqO4eS4h4GSyW3Pqu5KfUwcaY96CfRBy-se_w-YJTJSGlvm5VE-pRaNHcxUUngUHVYRCxSGzpj9IJpf9Brltg-fHatwfAJI0VD8jms8sGfQCPJdyFDRb3pc4vh0qgoUWzzR-bbQ_UcPrCMPTo06IEJUzT9vumN6TyDpuWrdVhWQ9om-oQ0PZKuG53OMWOOdsSDaUxUnHiAgVMN0_qgjUCaJfdsWDtqXLn385hFbR1YlUvEpgtr2ipi_2fNvb4LtvuVtG8_iGNtdPRVppaBgCesYp-0Csa_c86E-UO45ff9lCq4%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:2444 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 493b5758e7a7b6ec1f8329e5064fd50abbfbad76ee8d86ff47db0a0d5abb08f7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "68f01c31de33d8e78b1e8b9aae2cad9a"
Connection: keep-alive
Expires: Wed, 28 May 2025 07:08:50 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 3456
Date: Wed, 28 May 2025 06:53:50 GMT
Content-Type: text/javascript
Last-Modified: Mon, 26 May 2025 10:10:38 GMT

GET
H3 200 99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js Show response
pagead2.googlesyndication.com/bg/ Frame 74F5 54 KB
20 KB 141ms
141ms Script
text/javascript 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/99lcxn2YvEFuFPB90BzYKtdfgSsvSUIzwZpxI2siobo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

server-108-139-47-13.jfk50.r.cloudfront.net

Software

sffe /

Resource Hash

f7d95cc67d98bc416e14f07dd01cd82ad75f812b2f494233c19a71236b22a1ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 374984
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Sat, 23 May 2026 22:44:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 23 May 2025 22:44:06 GMT
last-modified: Mon, 19 May 2025 09:28:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 20818
x-xss-protection: 0
server: sffe

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
95 B 704ms
702ms XHR
application/octet-stream 44.222.0.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250527.5/main.9a246b8b1f07b7fdf439.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 44.222.0.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-222-0-2.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Wed, 28 May 2025 06:53:50 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H/1.1 200
OK dv-measurements7830.js Show response
cdn.doubleverify.com/ Frame 4FBD 453 KB
88 KB 154ms
153ms Script
text/javascript 2600:141b:1c00:44::17db:2444
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements7830.js
Requested by: Host: qsadv.posambient.com
URL: https://qsadv.posambient.com/hqmipqzfqaykbtlxntnqcyRRUMxbHhlcjhnOTRxUGlzMDdNRFItMzE5My0yNjcyMDQyOS0wZmQ3MDI3MS00OTUxLVQ3TzBwSlZERVZnY3k2cTBsRmU3/tbroiuluzmkbfl6ho2rvqdeovn8w38/lbonssjnbosycwzemkgmtj/tyqgjhsaritav
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:2444 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 98e7a27bc8ae3013e1002233ae2dc9be6efb80af1107fd2bb3845aad4ede64ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=31536000
Content-Encoding: br
ETag: "9d9e7d93087f14b72bfbf7ad5c9a7e2b"
Connection: keep-alive
Expires: Thu, 28 May 2026 06:53:51 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 89883
Date: Wed, 28 May 2025 06:53:51 GMT
Content-Type: text/javascript
Last-Modified: Mon, 26 May 2025 07:48:47 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 5173 44 KB
0 140ms
139ms Script
text/html 104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 56524eddd32d063ae05e13e3617e2f47e15a533e15a69f483ff4c24bea89fb3a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=73384
content-encoding: gzip
expires: Thu, 29 May 2025 03:16:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11450
date: Wed, 28 May 2025 06:53:48 GMT
last-modified: Wed, 28 May 2025 03:16:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame F48A 44 KB
0 140ms
139ms Script
text/html 104.77.222.83
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.77.222.83 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-77-222-83.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 56524eddd32d063ae05e13e3617e2f47e15a533e15a69f483ff4c24bea89fb3a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=73384
content-encoding: gzip
expires: Thu, 29 May 2025 03:16:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11450
date: Wed, 28 May 2025 06:53:48 GMT
last-modified: Wed, 28 May 2025 03:16:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame E03A 9 KB
9 KB Font
font/woff2

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2a620219bb8b54a91ae2bc06b1aa7952d58246867e3e02581ef77fab648e533e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://realtime.clinch.co
Referer

Response headers

Content-Type: font/woff2;charset=utf-8

GET
DATA 200
OK truncated
/ Frame E03A 8 KB
8 KB Font
font/woff2

General

Check archive.org

Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd5f9e0c371961ed5caad682dc3d42c344b06781cc3e9c381d749b6fcf822324

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://realtime.clinch.co
Referer

Response headers

Content-Type: font/woff2;charset=utf-8

GET
H2 200 /
img-cdn.clinch.co/img2/pfzb1W/300/300/1/0a0a0a0/ Frame E03A 21 KB
21 KB 584ms
149ms Image
image/jpeg 2600:9000:2512:800:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://img-cdn.clinch.co/img2/pfzb1W/300/300/1/0a0a0a0/?u=http%3A%2F%2Fmaps.googleapis.com%2Fmaps%2Fapi%2Fstaticmap%3Fcenter%3D38.0733019%2C-97.8946981%26format%3Djpg-baseline%26zoom%3D15%26size%3D600x600%26scale%3D1%26maptype%3Droadmap%26language%3Den%26key%3DAIzaSyDSwY-YP97NL7BfyG13Sartqiw608SjmvU%26sensor%3Dfalse&ctx=lcDOAAG9WM35Z84AAWlJwA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2512:800:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

f27488aba78a02557d57532d7d799da45a7e95fd733cb24770723b4a0cd25131

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://realtime.clinch.co
Referer: https://realtime.clinch.co/

Response headers

strict-transport-security: max-age=31536000
cache-control: public, max-age=645541
age: 16824
via: 1.1 e4139980c923137f619eb979df36e416.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 21196
x-amz-cf-id: wEqF-CLzLnU9YHdDhIpiiwaYWkYTEkmPuSEvjCvmlGyF8afLqM-38A==
date: Wed, 28 May 2025 02:13:27 GMT
content-type: image/jpeg
x-amz-cf-pop: JFK50-P7
server: clinch
access-control-allow-origin: *

GET
H2 200 /
img-cdn.clinch.co/img2/pfzb1W/32/50/2/0a0a0a0/ Frame E03A 744 B
1 KB 558ms
123ms Image
image/webp 2600:9000:2512:800:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://img-cdn.clinch.co/img2/pfzb1W/32/50/2/0a0a0a0/?u=%2F%2Fcdn.clinch.co%2Fa_styles%2F18685%2F63867562115704.svg&ctx=lcDOAAG9WM35Z84AAWlJwA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2512:800:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

5766a90c0c59cbbc9867472cf2bfe32f17dcf6e54ee60cb282a85f5535ed7cbc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://realtime.clinch.co
Referer: https://realtime.clinch.co/

Response headers

strict-transport-security: max-age=31536000
cache-control: public, max-age=644595
age: 235027
via: 1.1 e4139980c923137f619eb979df36e416.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 744
x-amz-cf-id: LICdPwH2BDhEwTFth1f-tDxFkFPc-9uLs3aHqQVIXihLRflCJI5ikA==
date: Sun, 25 May 2025 13:36:44 GMT
content-type: image/webp
x-amz-cf-pop: JFK50-P7
server: clinch
access-control-allow-origin: *

GET
H2 200 /
img-cdn.clinch.co/img2/pfzb1W/107/15/2/0a0a0a0/ Frame E03A 1 KB
1 KB 559ms
125ms Image
image/webp 2600:9000:2512:800:5:393a:f0c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://img-cdn.clinch.co/img2/pfzb1W/107/15/2/0a0a0a0/?u=%2F%2Fcdn.clinch.co%2Fa_styles%2F18685%2F63867568944320.svg&ctx=lcDOAAG9WM35Z84AAWlJwA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2512:800:5:393a:f0c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

2905d10f7d0dcb1a3c3198643902e743306b6db0f2fd899bfb22040b30d699e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Origin: https://realtime.clinch.co
Referer: https://realtime.clinch.co/

Response headers

strict-transport-security: max-age=31536000
cache-control: public, max-age=645804
age: 85344
via: 1.1 e4139980c923137f619eb979df36e416.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
content-length: 1042
x-amz-cf-id: 7MIoejExyTrarD1r948X_YSqUdTTBeqiigpvvxLXpjvfISIt5-6Dtg==
date: Tue, 27 May 2025 07:11:27 GMT
content-type: image/webp
x-amz-cf-pop: JFK50-P7
server: clinch
access-control-allow-origin: *

GET
H2 200 imp
trk.clinch.co/ Frame E03A 43 B
366 B 656ms
135ms Image
image/gif 108.139.47.13
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://trk.clinch.co/imp?cid=pfzb1W&caid=63847&caver=111206&frmt=160a600&csid=92489&dsp=dv360&plcid=21995275828&plc=1709948&iid=f9118eb5-b9b0-45dd-b5e4-ee477d944048&env=web&hid=efefed15-396d-461d-888b-d1cb742afa9e&hids=kZIyrzE2Mi4yNDUuMjA2LjI0NA&fcpath=kpIGAZIEwA&trkcntxt=kZGS0gAAACiTBqYxMTQwMDgM&prd=Promo&ids=Promo&isrc=promo&lpsrc=Campaign&locfeed=12138&bizid=114008&locsrc=Ip2LocDb&loc=x0xj0gAAAElx3AAXy0BDAAEAQcvAWIAJAPAHA6JVUwOhPwOtVW5pdGVkIFN0YXRlcxIA8AuhPwMAAKE_A6hpM2QgYi52LgMBA6Fio2hzdA&bizgmethod=Nearest&dist=12311&tags=DCO%2COfflineEvents%2CDV_UM&dspiid=ABAjH0je9dT_JlHYjp9O-bw5OIdE&dsp_caid=21995275828&dsp_pub_id=1&domain=paint.toys&dsp_insertion_order_id=1018126635&dsp_crid=618413339&dsp_c0=21995275828&tc=&a=1748415231093

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.139.47.13 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

clinch /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

strict-transport-security: max-age=31536000
x-robots-tag: none
cache-control: no-store
via: 1.1 500a5a4e72d986068e53ce22c8372bde.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
content-length: 43
x-amz-cf-id: ArY102SaXZnMyUSFwJPFSftxcfNB-XmewbeWFNGeKTpfPcdn12DzKg==
date: Wed, 28 May 2025 06:53:51 GMT
content-type: image/gif
x-amz-cf-pop: JFK50-P1
server: clinch

GET
H2 200 view
tpt.dotomi.com/event/etc/ Frame E03A 43 B
177 B 633ms
632ms Image
image/gif 205.180.85.204
CNVR-US-EAST

General

Check archive.org

Download Go to Show image

Full URL: https://tpt.dotomi.com/event/etc/view?vndr_id=2719&vndr_name=Clinch&comp_id=83764&campaign_id=101532&dvc_id=&ggl_play_id=&idfa=&ad_id=&audience=&client_campaign_id=&creative_id=92489&placement_id=410551860&s_id=&site_name=&cachebuster=638840120303378516
Requested by: Host: realtime.clinch.co
URL: https://realtime.clinch.co/video/player_v1/player?cid=pfzb1W&caid=63847&format=_160ax600a&dsp=dv360&plcId=21995275828&plc=1348273&dsp_impression_id=ABAjH0je9dT_JlHYjp9O-bw5OIdE&dsp_c0=21995275828&site_url=https://paint.toys/oil/&dsp_pub_id=1&site_id=1995081996404&dsp_insertion_order_id=1018126635&dsp_caid=21995275828&dsp_crid=618413339&dsp_tracker_token=AOjeLNEAAABpCmEKDAgAFQAAAAAdAAAAABIMCAAVAAAAAB0AAAAAIhQItIyV-FGoApm3-qIEsAKrwr3lA0AB0gIqGAAiEwj7m6ikysWNAxVcpFoFHSdyKWIoATABOPvciZi2E0ACSAFYiIEgEJv68KYCDRdlchQ27KHeB0Fe17xoMQ&rnd=1748415227235835&gdpr=0&gdpr_consent=&gdpr_pd=&env=web&clkUrl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCSarW-7I2aLuyDtzI6toPp-SlkQam9tD6e_vciZi2E-3r3uHoRBABIPub1UlgyZ72hoCAoBmgAdKG75opyAEJqAMByAObBKoE5AFP0IEUejxABQGNTt2Aro-WgDhKbwFaugOSGYn8-isZ14pm41NcS9ssk8SfJWGi3CS4qYnFd2IWv_UTIVsFD3LOaxrEQYcNAa1S3WJffg1KjnRlPZdtWCC-f3l06QGjI_XYtcGqPGEmavc_Q1Y0fnj_TDqfJsjEQAdpIxY4nR6RTbLjyQyoLpmT1fbhzVxQxTNcyav3tLE4C6TDNZaV9zbKZ42X9OQ8mTNKDJL6glJaaVfU7GSSA7fIFNhVebrhancwH3Rc7Y9Mkp_KNa_YP-kw4YBwev_kgsVROae3sQtyI-bXBtXABJbx1sD1BOAEA4gFtIyV-FGQBgGgBk2AB9K-v_oDqAfVyRuoB9m2sQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB-C9sQKoB47OG6gHk9gbqAfw4BuoB-6WsQKoB_6esQKoB6--sQKoB5oGqAf_nrECqAffn7ECqAf4wrECqAf7wrEC2AcA0ggpCIBhEAEYnQEyAooCOg2AQIDAgICAgKiAAqADSL39wTpY_cCmpMrFjQOACgOYCwHICwGADAGqDQJVU-INEwjd86akysWNAxVcpFoFHSdyKWLqDRMIx8SnpMrFjQMVXKRaBR0ncili8A0BsBOf1OQcyBOrwr3lA9gTCtgUAdAVAfgWAYAXAbIXowEYAiqeAS8xNTQwMTMxNTUvMTAyNDg3Mi83NDA2OC9wdWJsaXNoZXI6MTAyNDg3Mi13ZWJzaXRlOjc0MDY4LTE2MHg2MDAvcHVibGlzaGVyOjEwMjQ4NzItd2Vic2l0ZTo3NDA2OC0xNjB4NjAwLUNQL3B1Ymxpc2hlcjoxMDI0ODcyLXdlYnNpdGU6NzQwNjgtMTYweDYwMC1DUC0xNjB4NjAw6BcFshgJEgLMZxhNIgEA%26ae%3D1%26num%3D1%26cid%3DCAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB%26sig%3DAOD64_0Tw2qGvf9aRlIGRKclxga4Xn03YQ%26client%3Dca-pub-5812357352335075%26dbm_c%3DAKAmf-CMEZumeFzo5htbjl_Si5kUKoEpAl_uAkge-ocT-1uOoJ3yDVONl_lnVxaia8PEpEtta3E1tzrWib7AujrVZHg24L8gef0HkaPjewq12Cnpd-kD2RxHbVh5A9V-bBizx6FU-DJ1QExHcc1EwiZj04wW_hLtBMSDbrifoS_D4eRUOs9mCA-E0-Wn2Yew1cAUMpl0_K1W9ntkAm_vGtWLl-EDE04moiEQEJTFxLnnLpJQTYJppWwxOZz4QcPRF2hzovwrlr8rOg2ysPY801E3ylZG1JMwbw%26dbm_d%3DAKAmf-B4lG4UWlV9fvCb4fvuKWQqqZuNnulYciR7zm3SpjJlquyOPK-YW5_BkWlL7fSz1MwZlfVIuOhnSH-qA4xJDnp_LI8TC2e_VGaURrHBjX9Ab4fHdBWU4tW-eOFCdTnkBLXFhPWKokKb2GCJ7roUmoPY7taTheW24EsHfITcPdrkdiolG7zgyJD6_heQJqnFhBlN49rjSgrNJaJWhHci8nyuuxsPJh9wz9JQUIlHJY6BVq-Ig3nZyH-oGSDza-0bICClR60sM8O2N8U-oKumWJ0QztiBCMbCfBPAAJnMugwYAA5_DY7vNgSq_SrVt64MgTpDuLrkWs2Sk7Hkfvm0ce38FJJ6PUdshHINb3Gow-nYYnVcsa1tjTrgrpYYlaZqlVIqirqO4eS4h4GSyW3Pqu5KfUwcaY96CfRBy-se_w-YJTJSGlvm5VE-pRaNHcxUUngUHVYRCxSGzpj9IJpf9Brltg-fHatwfAJI0VD8jms8sGfQCPJdyFDRb3pc4vh0qgoUWzzR-bbQ_UcPrCMPTo06IEJUzT9vumN6TyDpuWrdVhWQ9om-oQ0PZKuG53OMWOOdsSDaUxUnHiAgVMN0_qgjUCaJfdsWDtqXLn385hFbR1YlUvEpgtr2ipi_2fNvb4LtvuVtG8_iGNtdPRVppaBgCesYp-0Csa_c86E-UO45ff9lCq4%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 205.180.85.204 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS: iad06-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://realtime.clinch.co/

Response headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
content-length: 43
date: Wed, 28 May 2025 06:53:51 GMT
pragma: no-cache
content-type: image/gif
server: nginx

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 3D26 7 B
1 KB 510ms
129ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK pixel Show response
ps.eyeota.net/ 1 KB
2 KB 130ms
129ms Script
application/javascript 34.231.251.31
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel?e_rc=1&pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
Requested by: Host: ps.eyeota.net
URL: https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_fa197e82-226b-4be9-abb3-ecc4a4f77092_1748415225274
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 34.231.251.31 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-231-251-31.compute-1.amazonaws.com
Software: /
Resource Hash: b431f3ab56fc4238f05981943908ca7a04ad72dd7adc660ab669c4cf011aeb80

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1280
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Wed, 28 May 2025 06:53:51 GMT
Content-Type: application/javascript

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 74F5 0
20 B 150ms
150ms Image
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B4OZu_bI2aPHbGYydoPMPhonT6QQAAAAAOAHgBAI&bg=!rK-lr-DNAAYA59AtIOc7ADQBe5WfOCSTBlJoBqKGyA40oYg6YJ_739PieRWQs8JfKMLXdvAXljDL2U9KKwLuXS_ZXTbUAgAAAINSAAAABGgBB34ANde1eyUEB_PldO6ABhowwwFxd2Rgf3G7JHtj5tUx7mFwjf8kj_cvWx6XCX6MFdjQ_QrqUcdRmQKTHkcFldVcOaabf1A6304jWCimhLKrzTnC7u-G5Q0ryAd_49zxdt-oeR68ereBbnZ0dSAkE2-2odpkUWDSUalNGciwtB59MSxHCtnnIOh2-5XMTJZhI28Dl-LHg5StnqVd8ucfpPbN2XUN2ZY6KoXcIxnj1Enk5VRGgk8ZXpXa0VFm6fF-V8upQvkueR7CPFw8x24VSaROgy0DVE8OapsWAswxcjY1XRIZb_Y8CoPtCMRjswGG4uwDItiKvgjNvUHMDoftkwRGfyW7xWf2Bk-YQNiJw5Z2z8riDAvkrxr4jYuWiG4U429ZU2uJHJJUVbcXwYl6qozMKF3hGMMuVetaoNb70GKs5vS-HkaoqUt4upIEQ0NJHsWDssQMW0yXAySqtci3s1jW0RcGzW7BLBKhtbjwLpH-eFjltQQ07lpq_zvygPFXWF7UyASnG2-EJhCZyWMQFDjZw7cXxZoHMQWaZw4kg8ANJxF8vJ6SU4ZlvmEQkO_RfAncfm6e0z3quC86XbBPFoLRmSpB1-7CB8N8TYt-OAJ5ir_RrAS8134RY2QBIiJOwu7bchr1VAHO90KHBvGQCh_0dRSwqYHm-QL9SnXCTDwxD4Nh964bjSSvFDE4-DJqMgjZ1spLhGqOkftmgxHouRFwQfXh_hwADdefcitlRmtQWqnm9u-oUwgHAoDky6-F-o_hK97kIS0vXzaImWHPs_XotYjPcIJZccarV43i8guzpp-j0Xi7pMHmvOe9tkBbHgPWEaIhs2ANuWaiFVYx3XSTgc0H-NftI3hWvZQxYP1jTtT2flWNv4bJwa92JA1D6ETY4SofladKRf5N9NUu4m-2LWhpYNnutIs1FkDPjT3DP0iwYxN8iRjZmKaOQhs

Requested by

Host: a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com
URL: https://a0f92d528e9e73135b1090a112f59a8a.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 28 May 2025 06:53:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9021 42 B
65 B 161ms
160ms Fetch
image/gif 142.251.40.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuX_Khq2Z9VC-Yy8H7YYjYmDbecnaDjLqhM32PO64Ljc4QbMAaOrpUMm4LvuxRY9fWaS5j7X9l_Q7QHkPzmPMBVtsmg-a2oVYM2unifh0YFhoU80FY4xTJCjmUxeKtYeX8PM06pSBGCYJCef8przvRz2IzhAMKJVbj6PYCJlNfEDLTVF11SqCyzJRSE-dUTc0clacxJBQ6f&sai=AMfl-YTUINgy5FjWpyx6JwypP81r8lqPlMk_0Lbtpx5INcV3n4ISEO2uYscVPU-w_QUjD2TO4SkJmUQ8z1zVUBe2HrQMQZhGVNN795H7Wyoh6U_8e-aR6pzm-S6qvA2XVXHkcwe72wz4Qch1T8ppTL-l&sig=Cg0ArKJSzLlzM0LOHwOqEAE&cid=CAQSTgDZpuyzygT45kjtorAGzDZPpB7PLm7zkpKyy6gJKHBCzBCKIFxWHouCEdO0iOM8vqT5qpxl4D7eCgc6s-tiRxQqFGsquXsG857R3VKZvRgB&id=lidar2&mcvt=1000&p=313,20,917,180&tm=1023.7999992370605&tu=23.400001525878906&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20250521&bin=7&avms=nio&bs=0,0&mc=0.99&if=1&app=0&itpl=20&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4434803000&rst=1748415228270&rpt=2152&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.130 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS