paint.toys
15.197.167.90 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 14034
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1668
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 02:58:09 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JWCZKHGX7J43VZY8BBNSWKG7

Redirect headers

accept-ranges: bytes
age: 14033
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 02:58:08 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JWCZKHEATGF1JSKDNQBG9XF7

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 368ms
203ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e589e9992e32f7d32d5ab797ea1f8de30a3018c83647e3409043b8e6e861747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 9472ba781cf67c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 163ms
162ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 77331
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JWCZKHKP3Z6YD723WNZK5D7P
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 82ms
81ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 14033
accept-ranges: bytes
content-length: 1209
x-nf-request-id: 01JWCZKHKPV8E48WKX7Q9WQZHC
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 97ms
97ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 112041
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JWCZKHKPHG3THE2M623GS79Y
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 82ms
82ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 77331
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JWCZKHKPCZ6KJKJ2JT96TD4V
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 82ms
81ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 77331
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JWCZKHPXB1QDXT9QJ0PMJMMN
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 82ms
81ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 77331
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JWCZKHRVKEX8TBHGENFCBWVE
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 02:58:09 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 104ms
103ms Script
application/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f465f9fefc8876352fe1cdfb75c1235bfd21dafe9644c565541e0e6ee8608f3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 9472ba782d007c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
126 KB 560ms
173ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e94e2d24de046769143a395e7150b344c3935f7129535356b3ab603f1e1fa56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 02:58:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:09 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 127920
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 l5fne80l3kwl-prod.js Show response
faucetfoot.com/scripts/ 68 KB
25 KB 298ms
103ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/scripts/l5fne80l3kwl-prod.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

c18c1e5eb2868a5750342d53a76cf420a4ca4b9c028eed1cffd5784163e43aa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-west1-pddz.gce-us-west1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 109 KB
34 KB 445ms
159ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

776a3becee48b05ec5c491f295acaaa0ecc99658cd99f6b06cb777376129d814

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 44 / 20237 / m202505200101 / config-hash: 3385491783623399952
x-content-type-options: nosniff
expires: Thu, 29 May 2025 02:58:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34390
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 589 KB
180 KB 101ms
100ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8110ded3886a93d34096358d663e7c487101a735b4720a076ed8ba4af6f00f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"369edfdc43d190015e70ab72de8421b6"
age: 2871
cf-ray: 9472ba797e8d7c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 18:09:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 411 B
362 B 86ms
85ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 873077f505ed9a2ab737917ab1975a275fe12309a5d3342cdd9abf68a05d672f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"7fd9352c65db194dec16fb4e09a7fa99"
age: 1716
cf-ray: 9472ba797e917c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
393 B 280ms
103ms Script
application/javascript 2606:4700::6812:18f2
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18f2 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30db30bc6a44847f68ecbb97bf4d48c0763ccf4fe87d6426d7d8153377ec9325

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 9472ba7a9bed1017-LAX
alt-svc: h3=":443"; ma=86400
content-length: 22
date: Thu, 29 May 2025 02:58:09 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 runtime.a088001b29a202d4ae31.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 3 KB
2 KB 147ms
147ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02e387c0ca7dad9064b8cd6c46d54be6c716d687db0f5554c567b1a8215620cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"83c44cf57817ee03c45b0f60d411b58b"
age: 1715
cf-ray: 9472ba7a0f057c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:44 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.80efcc48269da6666d6e.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 521 KB
158 KB 148ms
148ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cc875e681008e74d84ab9c500342af1938c8b50551cf5b1bf87b3310ad9e8d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"834b7930c1bf650af83c3fc3cb164788"
age: 1715
cf-ray: 9472ba7a0f087c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:09 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:40 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
482 B 420ms
134ms Image
image/gif 2600:9000:247b:4400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?adspot_id=bhjriv_728x90_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:247b:4400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 30112
x-cache: Hit from cloudfront
x-amz-cf-id: ZEw4kSvKYB0wUiY_PN405Zy1QKyQOiDlrUztFVB8M0UnfN8Y8h8_SQ==
date: Wed, 28 May 2025 18:36:19 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 8af02ce0419e91e83834b7deea9dd962.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: JFK52-P2
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 559 B
463 B 88ms
86ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 1715
cf-ray: 9472ba7d5a4f7c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame 3C9F 503 B
426 B 301ms
88ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3345fb969ca2f2bfdbe013d5977ea8bc8326c87ec220290f568ad1257ebfc4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 1716
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9472ba7eaecc1001-LAX
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 02:58:10 GMT
hw-country-code: US
last-modified: Wed, 28 May 2025 16:25:37 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame A187 503 B
0 300ms
300ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3345fb969ca2f2bfdbe013d5977ea8bc8326c87ec220290f568ad1257ebfc4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 1716
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 9472ba7eaecc1001-LAX
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 02:58:10 GMT
hw-country-code: US
last-modified: Wed, 28 May 2025 16:25:37 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/22/desktop/Chrome/ 584 B
920 B 460ms
135ms XHR
application/json 2600:9000:24f1:6c00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/22/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:6c00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bc1d81843e8b89b407e216983de25a0bd7b7eb168d17e39830daf8e2287d8216

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3226
via: 1.1 74e6dd86eff86d5443ebe1a2ced7df88.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 584
x-amz-cf-id: 4CuJmKbn24jgZuVXNu28B_W68r6zYrXZ03tTPiW3wnAfJdjFTXt6sQ==
date: Thu, 29 May 2025 02:04:24 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 147 KB
39 KB 242ms
84ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c6ef163d29f17126aa27a4c8508a08b53eb1f67680d3e22d7d2cc11f6cf8d26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "fa4592365bccd213c9a48f3d23404125"
via: 1.1 google
cf-ray: 9472ba7e6ff57c30-LAX
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39462
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/javascript
last-modified: Thu, 29 May 2025 02:49:41 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ccpa.ece3dcdb70f9ed1d3e08.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 3 KB
2 KB 85ms
84ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/ccpa.ece3dcdb70f9ed1d3e08.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d37165d73847e06c06bb7b327ae5afce03ef9b4274cf6b3ca8bb38310e0bfda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"a92a48be313e44de4d9109579ffdc31a"
age: 1716
cf-ray: 9472ba7d7a627c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:36 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 456ms
152ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0ae597c862464cf3f93f27ed75e5ccad9de4d42e78e0c6bab716c1adcf6c7a67

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"0d3ee470bc13a3093281c3682e3795e1"
age: 1874
via: 1.1 b471d3775e81a9be536b52b99f39452a.cloudfront.net (CloudFront), 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 9jOsKlUVafc4liKOxas60oVnUJM7AozNtKXnSNL2wHA4GRTXpAN0DA==
date: Thu, 29 May 2025 02:26:57 GMT
content-type: application/javascript
last-modified: Wed, 28 May 2025 20:29:48 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
583 B 686ms
224ms Image
image/gif 2606:50c0:8001::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8001::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 8dd8bb10bdf6bd66663a3140c9ff77dcaf2ddfdf
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: B5AA:155858:176DB6E:198DB48:6835F75E
expires: Thu, 29 May 2025 03:03:10 GMT
x-cache: HIT
date: Thu, 29 May 2025 02:58:10 GMT
content-type: image/gif
x-served-by: cache-mad22037-MAD
x-cache-hits: 2
source-age: 280
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1748487491.693637,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 135ms
135ms Script
text/javascript 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 55205
x-content-type-options: nosniff
expires: Thu, 28 May 2026 11:38:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 11:38:05 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/ 63 KB
23 KB 143ms
142ms Other
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.176.8.34.bc.googleusercontent.com

Software

cafe /

Resource Hash

9b502c40cea58eb57328f78cf48c787ab82d46606203a135bbb813ee19fb6c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8651680878418282224
age: 18070
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 21:57:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 21:57:00 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23432
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505270101"

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 446ms
146ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 29884
via: 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 3MaDRaoaO91E58X60SWmelQNotzvEnoi_GV_Qz0XecDmNbAUmw2u0w==
date: Wed, 28 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
111 KB 160ms
159ms Script
application/javascript 2607:f8b0:4006:820::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55r0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635~104573694

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1729f8c1b276dabc0bbaf445d1b7c62926a90083e739d1081a19fc61859388f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 02:58:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 113710
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 431ms
150ms Fetch
text/plain 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55r0v9101576445za200&_p=1748487489107&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635~104573694&cid=1081789068.1748487490&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748487490&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fcwqds.awadwatt.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1873
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/plain
server: Golfe2

POST
H3 200 h19dk7nabelu65yfj7i6bi53 Show response
faucetfoot.com/0/ 295 B
319 B 183ms
104ms Fetch
application/json 34.8.176.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/0/h19dk7nabelu65yfj7i6bi53

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/scripts/l5fne80l3kwl-prod.js

Protocol

Security

QUIC, , AES_128_GCM

Server

34.8.176.186 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

ba22cf6e7c3c8a33edca180f23fc629ea05bb86c5bcbc6503b255cfff07d4a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-west1-test-jqg4.gce-us-west1, 1.1 google
expires: Thu, 29 May 2025 02:58:09 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 269ms
122ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
567 B 248ms
89ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 7998
x-goog-stored-content-encoding: identity
expires: Fri, 30 May 2025 02:58:10 GMT
x-goog-stored-content-length: 43
date: Thu, 29 May 2025 02:58:10 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9472ba802cc9cba2-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 290ms
135ms Image
image/x-icon 142.251.41.6
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f6.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 16589
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 29 May 2025 22:21:41 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 22:21:41 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 248ms
90ms Image
image/gif 2606:4700:10::6816:541
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.10853805309954834
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:541 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 7998
x-goog-stored-content-encoding: identity
expires: Fri, 30 May 2025 02:58:10 GMT
x-goog-stored-content-length: 43
date: Thu, 29 May 2025 02:58:10 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyIvADnYWOUb5jEm4_FzJUWhbO4MtWdR3CW9LOgPyl2KoiXV45BFAu-_fMSm0k0Cii1oqQSG6
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 9472ba802cc5cba2-LAX
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame 3C9F 17 KB
7 KB 89ms
89ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1716
cf-ray: 9472ba7f4f581001-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame A187 17 KB
0 80ms
80ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 1716
cf-ray: 9472ba7f4f581001-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:38 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 149ms
148ms Fetch
text/plain 2607:f8b0:4006:80d::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55r0v9102396898za200zb9101576445&_p=1748487489107&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635~104559070~104559072~104573694&ptag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635~104573694&cid=1081789068.1748487490&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748487490&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fcwqds.awadwatt.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1748487489107&tfd=2150
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55r0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635~104573694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:80d::200e , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/plain
server: Golfe2

GET 39e1705d-1c98-42ce-b8c1-88b0c187b273
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 404ms
131ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 02:58:10 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 195520
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 230ms
133ms XHR
application/json 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.11.207 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 80729
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Wed, 28 May 2025 04:32:41 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 9472ba80f8612f63-LAX
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 3 KB
1 KB 85ms
83ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 1715
cf-ray: 9472ba806d8a7c47-LAX
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 451ms
135ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: ad5d3fd5c9cbda401e9fe23bf964d0ac13ce6b5c87608bd422d86d32215988a7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 447 KB
141 KB 467ms
179ms Script
text/javascript 2607:f8b0:4006:807::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a0d8647aeab78d89cb0c09509b13d78b932a9491a09aae58c4840660f22bef7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5341538035048807860
x-content-type-options: nosniff
expires: Thu, 29 May 2025 02:58:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144316
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 667ms
216ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-54-88-163-74.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
778 B 445ms
146ms Fetch
application/json 3.216.183.54
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.216.183.54 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-216-183-54.compute-1.amazonaws.com
Software: /
Resource Hash: 10dd1e68c77fbff7480fcd29561a2697f0492939f52b86443d44897df62d4a1d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
682 B 433ms
135ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 823f777bc55b1c9cf9ca5adb4e01ec5ff4f337adae9ebabd5f5affdc3ad1d38a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 246ms
96ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 8359036c2ca3ff048fb443b6a0fc2e7874b191c5976fc8a3100eafb1a184ffc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
540 B 450ms
144ms Fetch
text/plain 54.88.163.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.88.163.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

d7245f1c43835fc30698458e62200b37eedd3926dfefd3408d2a43e50ae7f3de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: eb5b747e3543c01f
request-time: 11
access-control-allow-credentials: true
expires: Fri, 30 May 2025 02:58:11 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=iFgJWnxHRTEyQWczZ1hHai9zSmlpUHdrSEwwMnJzRUNXU1pMUkNzQk0rYmFDNSsrTFhuSTJaNkpOTEVNVHhzUnhZVi9lQkVjSEdUL0NjUngvYnpDK1ZSSjB0NXhNS1VSTGtLYmk4c2ZKc09mL0ZHUExkVDZpckNManZhZW...

354 B
924 B

391ms
130ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=iFgJWnxHRTEyQWczZ1hHai9zSmlpUHdrSEwwMnJzRUNXU1pMUkNzQk0rYmFDNSsrTFhuSTJaNkpOTEVNVHhzUnhZVi9lQkVjSEdUL0NjUngvYnpDK1ZSSjB0NXhNS1VSTGtLYmk4c2ZKc09mL0ZHUExkVDZpckNManZhZWpuS1l6allBQVBmdFRYcTBWZ01TeDJoK1FIeFMrMUVaYVdBcFdkREFCbVNvQjlmRTVtRXVrbk4wdktqUExEUGk2Z0QvUGM2ejF6WVZpamJsWWpTcHhxcU1ZNVhJc3N1emtYSGhVbzNZOWlDWjU5Mm9rV3dUMThNRktNVkFxSHRUZERIdTlFWCsvfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5f6d5a9a9c92645e75aa8aff0d618b42e56ad8c2f6fad6fcd36ad98c0937fed1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 591504
expires: 0
access-control-allow-origin: null
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=iFgJWnxHRTEyQWczZ1hHai9zSmlpUHdrSEwwMnJzRUNXU1pMUkNzQk0rYmFDNSsrTFhuSTJaNkpOTEVNVHhzUnhZVi9lQkVjSEdUL0NjUngvYnpDK1ZSSjB0NXhNS1VSTGtLYmk4c2ZKc09mL0ZHUExkVDZpckNManZhZWpuS1l6allBQVBmdFRYcTBWZ01TeDJoK1FIeFMrMUVaYVdBcFdkREFCbVNvQjlmRTVtRXVrbk4wdktqUExEUGk2Z0QvUGM2ejF6WVZpamJsWWpTcHhxcU1ZNVhJc3N1emtYSGhVbzNZOWlDWjU5Mm9rV3dUMThNRktNVkFxSHRUZERIdTlFWCsvfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 273178
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 02:58:10 GMT
server: Kestrel

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_5e8009cc-2fe9-48d5-b7fd-2e6eeeb3afef_1748487490579
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfNWU4MDA5Y2MtMmZlOS00OGQ1LWI3ZmQtMmU2ZWVlYjNhZmVmXzE3NDg0ODc0OTA1NzkQABoNCMKa38EGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=50a801041c7f93cc280dcb7887f5a90b6da3285d72e5f16072ba9c20af958d3c791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=50a801041c7f93cc280dcb7887f5a90b6da3285d72e5f16072ba9c20af958d3c791426b5417dce21&rand=01558571
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=50a801041c7f93cc280dcb7887f5a90b6da3285d72e5f16072ba9c20af958d3c791426b5417dce21&rand=01558571&expected_cookie=c85b7f1b-e87d-4d43-bf89-fa98dabe91bf

0
145 B

128ms
127ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=50a801041c7f93cc280dcb7887f5a90b6da3285d72e5f16072ba9c20af958d3c791426b5417dce21&rand=01558571&expected_cookie=c85b7f1b-e87d-4d43-bf89-fa98dabe91bf
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 2EB4AF8CD5CC43FC91B767A8D8DA06F5 Ref B: LAX311000108035 Ref C: 2025-05-29T02:58:12Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2PXfdSPTZ/XWqFcO2xA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: /db_sync?pid=10339&puuid=50a801041c7f93cc280dcb7887f5a90b6da3285d72e5f16072ba9c20af958d3c791426b5417dce21&rand=01558571&expected_cookie=c85b7f1b-e87d-4d43-bf89-fa98dabe91bf
x-msedge-ref: Ref A: 2DFAE6D8B2634728B726D9DE95D120C2 Ref B: LAX311000108035 Ref C: 2025-05-29T02:58:11Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2PXfbKNsOFDWdRxu3Gw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_5e8009cc-2fe9-48d5-b7fd-2e6eeeb3afef_1748487490579
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5e8009cc-2fe9-48d5-b7fd-2e6eeeb3afef_1748487490579

1 KB
2 KB

137ms
136ms

Script
application/javascript

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5e8009cc-2fe9-48d5-b7fd-2e6eeeb3afef_1748487490579
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: 12019b45a0cb931aa1e133c50eb1a0186d60ea415ae9ec116055f7a6ae45d6b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:11 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_5e8009cc-2fe9-48d5-b7fd-2e6eeeb3afef_1748487490579
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:11 GMT

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 203 KB
66 KB 469ms
178ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4151cd464e303c9e9d82ed012b838df7e91beaef1bc378ffa36de93a567a4ce1

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-fpevLLk13opEeEqRmHBuXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmLw0pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjNxlusW4G4Sfs2axcQm_ndZrUDYiFujsOz7h9kE-j48tpUSSMpvzA-OT-vpCgzqbQkvygtOS21OLWoLLUo3sjAyNTA1Mhcz8A4vsAAAJYzP44"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-fpevLLk13opEeEqRmHBuXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 country Show response
api.btloader.com/ 37 B
215 B 266ms
117ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 262ms
119ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=U2zre1xxQ-XUsr4HGp-9719f9cb54&sid=GrLElA04O-6tCEUK2YTw-9719f9cb54&cv=2.1.102-1-g48599ff&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:10 GMT
vary: Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
445 B 429ms
147ms XHR
application/json 35.172.207.211
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.172.207.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-172-207-211.compute-1.amazonaws.com
Software: /
Resource Hash: d008012130c9fb52e09ec64a56d77c3829fdecc119e87d810c211dd24d684d4c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=utf-8

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 404ms
137ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 3381
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: FNoVIVv-w7I8cEJBATFGGrG112vkZVJM5Sssc5PSUXf5-31tbWZPuw==
date: Thu, 29 May 2025 02:01:51 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 7225c7fb64d09bab64bc17e314ef26a2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
831 B 434ms
138ms Script
application/javascript 108.138.106.108
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.106.108 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-106-108.jfk50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 490
via: 1.1 313dd6f62ed18c58ce60182660a6ec46.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 0VvynrEHwRWGtX6oelJTSvcFx4lq787vA9v_cyJh-ob9QSIKWOZSVQ==
date: Thu, 29 May 2025 02:50:01 GMT
content-type: application/javascript
x-amz-cf-pop: JFK50-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 136ms
135ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 6647
access-control-allow-credentials: true
via: 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: Q_Orl5_tPpFjmP8vddEVlYlF_x-Jqqb-B4j9jjD_BtVWL5K52LqXXg==
date: Thu, 29 May 2025 01:07:22 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
374 B 747ms
325ms Fetch
application/json 13.226.100.198
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fcwqds.awadwatt.com%2F&pid=ZJH8ziQuDd5he&cb=0&ws=1600x1200&v=25.527.1456&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22us_privacy%22%3A%221NNY%22%2C%22device%22%3A%7B%22sua%22%3A%7B%22mobile%22%3A0%2C%22source%22%3A1%2C%22platform%22%3A%7B%22brand%22%3A%22%22%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=db9547e1-dc45-4f1c-b648-527077251760&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.100.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-100-198.jfk52.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 6c72f3d1226793372ca91070a470930e.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: LeU-ynoMkMdPNodKQtICdwydX1u74SrBkN7p3eLndz-qKbmdia7oHQ==
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK52-P10
server: Server

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame D4EF 2 KB
1 KB 375ms
121ms Document
text/html 23.44.17.14
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.44.17.14 Elk Grove Village, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=34088
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 29 May 2025 02:58:11 GMT
expires: Thu, 29 May 2025 12:26:19 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame CFF3 1 KB
2 KB 248ms
75ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2347
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:19:04 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: ABgVH8_M8PIPYoX2E5DuOymP2wzJzBKuZt5MmMx3mURhN4ctPbtwbVelCD4s0nAEAx6WNRs6

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
2 KB 266ms
163ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4531298848731060d95357919a8b12febd3d40920987fa4c510e215eec981110

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487491&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=e%2B18SlyYKSu506v5zq%2FxIskKHK5O7GDgtR8zrQO%2FONk%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487491&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=e%2B18SlyYKSu506v5zq%2FxIskKHK5O7GDgtR8zrQO%2FONk%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9472ba830963d9df-LAX
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 427 B
1 KB 476ms
374ms Fetch
application/json 104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bec076130e1024b3dace7713d3f8e8c7d097bde2c0a9727716eed18c4a250911

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487491&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=e%2B18SlyYKSu506v5zq%2FxIskKHK5O7GDgtR8zrQO%2FONk%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487491&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=e%2B18SlyYKSu506v5zq%2FxIskKHK5O7GDgtR8zrQO%2FONk%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9472ba830966d9df-LAX
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 25 B
312 B 470ms
184ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

754662bc5c6fea5ac28763693192559153424da61e7f1c2ab800d8aad5273855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 2 KB
1 KB 374ms
223ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b63f37200a45e22f73bb2569c748e593ec629598d64c7608b2a2484f675a1a2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oRUWIUM02Cmk37t%2BC2gJySLrYOnNDKPZGC6geMG6G688lYkI6IJOk5IFgFHgCDNcZY6LsCSrfozt1LZcXcnNO9j%2FK9fQsy26GsHWP3YHTEP8iugzoyladDRL93C849pOJbo7A3CV"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9472ba836e8d7d4a-LAX
access-control-allow-origin: https://paint.toys
content-length: 557
server: cloudflare

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 414ms
206ms Fetch
application/json 54.70.156.240
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748487490927&to=600&aun=pw-160x600_atf&pubcid=4b233850-4f1f-4ff8-bae0-8bde593b3570&33acrossId=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=9b717269-e771-4627-8687-4246c8f2ea60&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9574&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.156.240 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-156-240.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 414ms
207ms Fetch
application/json 54.70.156.240
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748487490928&to=600&aun=pw-160x600_btf&pubcid=4b233850-4f1f-4ff8-bae0-8bde593b3570&33acrossId=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=46047aed-008b-47e9-9681-9e456c9a80a5&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9574&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.156.240 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-156-240.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 415ms
208ms Fetch
application/json 54.70.156.240
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748487490928&to=600&aun=leaderboard_atf&pubcid=4b233850-4f1f-4ff8-bae0-8bde593b3570&33acrossId=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=cda5dd67-4ab8-429e-9359-0c5fb93c7815&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9574&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.156.240 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-156-240.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 414ms
207ms Fetch
application/json 54.70.156.240
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748487490928&to=600&aun=leaderboard_btf&pubcid=4b233850-4f1f-4ff8-bae0-8bde593b3570&33acrossId=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&uspConsent=1NNY&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=57f8465a-c06a-453e-ad0e-617fa1039266&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=9574&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.70.156.240 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-70-156-240.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1085ms
513ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 29 May 2025 02:58:11 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1297ms
433ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 29 May 2025 02:58:12 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 897ms
290ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 29 May 2025 02:58:11 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H/1.1 204
No Content 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
1 KB 1138ms
286ms Fetch 209.38.60.16
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.38.60.16 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 29 May 2025 02:58:12 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 82 B
624 B 434ms
145ms Fetch
application/json 3.168.102.72
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-72.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 13f77a7be2d821bb102a13064c5027aebbc2e6a9e0c03b8a0338a812a8d535b0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 435c3774a9b74fb52b1b9bfcb82be3be.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 107
x-amz-cf-id: QCDdOnnG-RCjW_nQb9GgY5DkIQC9AMxscxeYR-9376pwWDGPgbrPfA==
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind hosting provider
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 400 auction Show response
elb.the-ozone-project.com/openrtb2/ 236 B
707 B 295ms
135ms Fetch
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6589f704aea9fcfe5d5fb76ec2827b5aeaa1b91d8e541f0c35a2b3de58a57983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9472ba839c187db6-LAX
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 236
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 494 B
1 KB 475ms
204ms Fetch
application/json 68.67.161.182
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

597bc3b7368e3c3392f32a213da74af42d66d5ff47511ad760a2f0e9b5833c77

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: a060cf26-e088-4195-bf0f-1add6a41e8a4
content-length: 494
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:11 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 700 B
1 KB 1381ms
386ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4b233850-4f1f-4ff8-bae0-8bde593b3570%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e3a00e20-a2ed-44a8-bbcc-a198716912fd%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.43.0&x_source.tid=efd63057-25a3-47aa-b6bc-d0b0f9f3aed2&l_pb_bid_id=984f9222b1b171c8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=9b717269-e771-4627-8687-4246c8f2ea60&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.8361922084459836
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: f0ef48206ef36c6665cfb3d88ed45fe9a7c7dcf9d73476e6a7ac667bd5dbe2ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 532 B
1 KB 1209ms
214ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4b233850-4f1f-4ff8-bae0-8bde593b3570%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e3a00e20-a2ed-44a8-bbcc-a198716912fd%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=efd63057-25a3-47aa-b6bc-d0b0f9f3aed2&l_pb_bid_id=99a6aa300d95bd08&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=46047aed-008b-47e9-9681-9e456c9a80a5&p_site.mobile=0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.7839569019501531
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c5db00c652432bdac18362e629bde45f48412b559f75724465b8e4c9efc5c5c3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 532
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 538 B
899 B 1251ms
257ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4b233850-4f1f-4ff8-bae0-8bde593b3570%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e3a00e20-a2ed-44a8-bbcc-a198716912fd%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=efd63057-25a3-47aa-b6bc-d0b0f9f3aed2&l_pb_bid_id=100eb5a8404c5c418&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=cda5dd67-4ab8-429e-9359-0c5fb93c7815&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.4794970026151235
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 0e7a4432051d268e344596a08dae30218a62053871fe83d91edc5dd065e258f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 538
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 538 B
899 B 1345ms
352ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&us_privacy=1NNY&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=4b233850-4f1f-4ff8-bae0-8bde593b3570%5E1%5E%5E%5E%5E%5E&eid_33across.com=v1.0014000001YrMoYAAV.1042.eMUQgKMd8ec6cSKj6SwAvM%2BwKwLjTYSusm%2BxeKhB1amY3gCQuzruG7%2FX1kWQrON4ZEYusRMhtwGgLm2zupJZxVIskW8JpiWpSvnhss14jMxkNtu%2B6dKQk7r8Bau%2FvNL%2BAZRvbnjC%2FbpBLryA7pBqp9ozBAJGv4Z2TDosxZUxpQyLMWy73r%2BqYQ7zDAtzLf8EEfxEVdZGaReqxAbme7UrGv%2BhNWAX395cqFXkGzYeoKpVKRh1SqEbqw1loMI8t17guE59%2BtjB5nSNvRjSTDYU3qqXUfk4tSSkZL8No%2BBuKS2YYBic1FdYvEImDJwWoyox2DyKVGiTPCzEMIZ2Gq%2BYTkPFNbaCZVTbwBmfkpQVasfaV3BRgxNgaPfc2zIFtYllGITWOrZbs37yCba4hUQKF9DPAqP52e0m31Uvqk6%2B8H7xWHXXjg%2F3jOmLtF4unWT%2Bu75ZMYregbdEclwbih48PGhjHCiXJ98d3QtNUM3CMP6D9SBfO2vOMhumDEYYkA8q8KTg2xNrf6HhmfXnUepLNGwwiwFw6cUovSyPK6rV00FSbsBwl13iw5qKEEAufgnmAqDkRztwxnanRwPpECJAhcJRActOTrha2ppla4bZ85mMLEg8rOjHucnSrXO6HxPcLjHjfwM%2F52A1Aycvl3O72DzLQagsV0ZD0H4%2FGmuPoJLcpVZUePTY6sxqX7I%2BYhKrdvZitzEIdBgl94VoDYAPB%2Bp%2Ff63uq87oAe7AwLTGt2Lw1AcXt1GqqFamxOoOVFfWFFrf5K8eZv4PypQ%2BcWdXOp3nX%2FuymJNSfmBnTaDQRUVU3TAtmR4if%2B3CkZdwEIKbyfb%2BtjgHVzuHo5MHq7ifOZ8Qqn6Rs5G8SOUvqQHNOt1S9OjHgttMyLKRSljnTip9%2FTcUQiDtxt4SVqWr%2FfdWeftbq9jscZtsr4vi4czV72QyJ72cWEsWSYsKppxQl2jYuAP24l7dJ49F7Ku1B51uaeIEzrXltAFZj8p4uvGMYc50t2b%2Fth4qlr55mB81I%2Bgi3Y4DmpZtSdMYEnvMrhZm1yVldk5g7ZhKu04WW7m94kDC59b26UKz2pssU6%2FKyzLM5r%2FLKJF2wFdsKDtGPSUchJkIpN6H9zBT2kIAXHVbOZ06e79F8SbByto1zdf6U1cuxoSGSvOkFg3dMyLjcMJSu5V2d5Y%2FBbWFAS92hdBn%2FG50NW8Qm%2BohZrmRKyJpJgnPVsSsK5C4YNtDoMU9ONp8ecPc9UEvx5ke%2FVnscgGJi%2Fipn9%2BkCkxhl3C0%2BCBy2GWLoVGyKaLdmSJ%2FMoveLINBIRJ2VcKRr5AHZJRPUVFo4kpLYJ1svwVf0MTLLnMnfM8h8bA0evAzfSAZZurjMU1q81WnoIL%2Bc6XjX3aQBikWnBEfEKF9nNKCb0L3li%2BDAa47UdSYClihLBgpobrdtrJaKFzJJifIeg8on4jvKsbKzIytXLjCGaORUD0DKz0n4QgdROoV0n64WUrsVZimT%2F2QRvi7z5mCdcOTU1yjiXIvaSfhxyO1HETkG%2B6%2FVV0pLEWf%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=e3a00e20-a2ed-44a8-bbcc-a198716912fd%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=efd63057-25a3-47aa-b6bc-d0b0f9f3aed2&l_pb_bid_id=10155728c31043df&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=57f8465a-c06a-453e-ad0e-617fa1039266&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.3201484547540788
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 2098151c2e41a1d5883aa88539f19d0d69c024f3e9b55deb5e30b5ae7886342c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 538
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
361 B 253ms
104ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 86b03bd74dd53826dbc9b1643e825521c00d726de45576ecaa5940a9d0dd28fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 162.245.206.248
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 29 May 2025 02:58:10 GMT
content-type: text/plain
vary: Origin

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 1662ms
326ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:12 GMT
server: nginx

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 608 B
744 B 664ms
374ms Fetch
application/json 3.235.195.108
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.195.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

681c65b0d64a7f8df40bd5bbd5cdb0b240ef1b13ae22f06a8238460a5c7ffe5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 388
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 613 B
738 B 511ms
223ms Fetch
application/json 3.235.195.108
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.195.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

5d3b36ced0e33be70030e4368d186bb305b20bfc72098b75f1169619853cfabd

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 381
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 761 B
774 B 573ms
285ms Fetch
application/json 3.235.195.108
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.195.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

333907c1ccf62c51063b036467f520eda695d075ed0c71ae071e9ba843379d29

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 418
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 548 B
753 B 577ms
289ms Fetch
application/json 3.235.195.108
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.235.195.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-233-167-98.compute-1.amazonaws.com

Software

Resource Hash

84f696db43840bcffdb0489505f0e9bb95b33e41d76f7e9be47f4eff4dbd9bf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 397
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 1124ms
406ms Fetch
application/json 3.233.167.98
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.43.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&us_privacy=1NNY&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.233.167.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 425ms
134ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 02:58:10 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
189 B 413ms
128ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.43.0&cb=81801449989&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:10 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 427ms
135ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 29 May 2025 03:13:11 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 29 May 2025 02:58:11 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 158ms
155ms Script
text/javascript 108.138.128.124
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.128.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-128-124.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 66112
via: 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GdRAAmfpY3eoFOj0YL6pVoq0kUtee4LOBcXXeqIlJZbprELhul6k_g==
date: Wed, 28 May 2025 08:36:20 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P4
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 238ms
80ms Script
text/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 713
cf-ray: 9472ba83dca572e0-LAX
x-amz-request-id: 30EMQ0Z48FGFG2GV
expires: Tue, 03 Jun 2025 02:58:11 GMT
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: Y9Tsv8H4ACJ9r/6lqnrKjUjIsOdMLXWZiKtj6D8uCQb1mMoof/kU2zmR/DTAp+kcRpuLmvYhuGU=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 253ms
87ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 532
expires: Thu, 29 May 2025 03:58:11 GMT
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
x-amz-id-2: ARTLOF8fvdJnwyqyxlCCsrr8nEuEGjLNVvlfOIL0Dbmn9IPS8Kd6yX6w43ZN1UEzGWEll+Brz2mHqyqopOErhh8GiGDyF7PNIW65mFnCJy0=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 9JYTHC4H5NNPE555
cf-ray: 9472ba83d8a79091-LAX
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 562ms
272ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 29 May 2025 03:13:11 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 29 May 2025 02:58:11 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1748487491118&did=did-0046&se=e30&duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awad...
https://rp4.liadm.com/j?dtstmp=1748487491118&did=did-0046&se=e30&duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awa...

13 B
369 B

421ms
133ms

Fetch
application/json

3.212.24.213
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1748487491118&did=did-0046&se=e30&duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awadwatt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 3.212.24.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-24-213.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 6412d129-bfd9-4a67-b39a-145431a6158d
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1748487491118&did=did-0046&se=e30&duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fcwqds.awadwatt.com%2F&cd=.paint.toys&i6=MmEwNDpjNjA0OjYxNToxOjo1
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 02:58:11 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 402ms
131ms XHR
application/octet-stream 100.27.136.39
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 100.27.136.39 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-27-136-39.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 2 B
188 B 539ms
134ms XHR
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 4b650e5c4785025dee7bd65e3c5c527356717d7a1c0bfef5b4ada8ca1e9cbe17

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 419ms
133ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame EB9B 0
412 B 417ms
133ms Document
text/html 52.73.180.144
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.73.180.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-73-180-144.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-length: 0
content-type: text/html
date: Thu, 29 May 2025 02:58:11 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0
x-reason: could not perform CS due to compliance policy: USPrivacyString user notice opt out is off

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 662ms
218ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=0a831894-4f5b-4a69-a2cf-c9858718c72e&bid=1e2n4ou

70 B
440 B

222ms
134ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=0a831894-4f5b-4a69-a2cf-c9858718c72e&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:11 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=0a831894-4f5b-4a69-a2cf-c9858718c72e&bid=1e2n4ou
content-length: 191
date: Thu, 29 May 2025 02:58:11 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=Mi1rTFNhRnFUc1l6T3FKc0Z4OXB4U014bjFXSnBGSTVHVWJSUVd4T1QyTm8&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=Mi1rTFNhRnFUc1l6T3FKc0Z4OXB4U014bjFXSnBGSTVHVWJSUVd4T1QyTm8&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15

70 B
440 B

218ms
136ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:12 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 334
date: Thu, 29 May 2025 02:58:11 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-23lD6X5E2pU3N7sxNkGdKBxUr2NinaMbnno-~A&gdpr=0

70 B
440 B

202ms
137ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-23lD6X5E2pU3N7sxNkGdKBxUr2NinaMbnno-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:12 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-23lD6X5E2pU3N7sxNkGdKBxUr2NinaMbnno-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3135167154967913612&newuser=1&referrer_pid=m51mh00

70 B
440 B

351ms
156ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3135167154967913612&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:12 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3135167154967913612&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 02:58:16 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=1564310468653297776&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

136ms
135ms

Image
image/gif

3.219.191.91
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=1564310468653297776&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.219.191.91 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-219-191-91.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 02:58:11 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=1564310468653297776&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 93bfe1a9-c751-4a67-a3f5-af3f5ae3bf83
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:11 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 260ms
84ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 7185
cross-origin-resource-policy: cross-origin
cf-ray: 9472ba86efee2b8b-LAX
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 28 May 2025 23:05:41 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 123 B
265 B 94ms
93ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d2e1940e06b5ba91f3e28029b20c2ed40712de0b1160313e95a716027bdaad5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9472ba86fdcbe57c-LAX
access-control-allow-origin: *
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 263ms
99ms Preflight
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 9472ba865b86e57c-LAX
content-length: 0
content-type: text/plain
date: Thu, 29 May 2025 02:58:11 GMT
expires: Fri, 29 May 2026 02:58:11 GMT
server: cloudflare

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 410ms
127ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 02:58:10 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 216909
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 AGSKWxUHUIS61gG_5Ncw4sdjB_tksfY2rFxDFaoso7aS3gY3_QsZeu-dTjZN5Zxp-oT9uJuNTj3Pm6IiXL15IcWGBwqbUP_LgD3umfTu1ywcQ0x1q842zYUgvIIzOiTvHyTCepfsv8pEWg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 174ms
172ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUHUIS61gG_5Ncw4sdjB_tksfY2rFxDFaoso7aS3gY3_QsZeu-dTjZN5Zxp-oT9uJuNTj3Pm6IiXL15IcWGBwqbUP_LgD3umfTu1ywcQ0x1q842zYUgvIIzOiTvHyTCepfsv8pEWg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDg3NDkxLDU0ODAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJnUFJEME5GZXE1SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJjd3Fkcy5hd2Fkd2F0dC5jb20iXSxbMjUsIltbMzEwNjE2OTBdXSJdLFsyOSwiZmFsc2UiXV1d

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8277b3f285105e7df6c7db206d9a6de7cb0e47639fff6180286a6ca83035b00f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-K161bTjbj5AOTmmOS_g4BA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw0pBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F418ZbrIeBuEn7NmsXEJv53Wa1A2IhHo7Ds-4fZBM40NW-lUlJIym_MD45P6-kKDOptCS_KC05LbU4tagstSjeyMDI1MDUyFzPwDi-wAAA7JhEnw"
content-security-policy: script-src 'report-sample' 'nonce-K161bTjbj5AOTmmOS_g4BA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame E014 102 KB
28 KB 410ms
137ms Document
text/html 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2964
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:08:47 GMT
expires: Thu, 29 May 2025 02:58:47 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 504ms
140ms Script
application/javascript 2600:9000:24f1:aa00:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:aa00:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 155
x-cache: Hit from cloudfront
x-amz-cf-id: csHxtOnFUk-Ds4RR9wt9bu8ra6hM966h7BdSYAy7h8u2aISMwWwYQQ==
date: Thu, 29 May 2025 02:55:37 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 d877346b368e974486e739220882b59e.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 227ms
71ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 107674
x-goog-stored-content-encoding: gzip
expires: Wed, 27 May 2026 21:03:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Tue, 27 May 2025 21:03:37 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: ABgVH88PbEhc4KNqtq7ttq1VkVdwKKf_1aitr_XckGqx8XMrZByumb4ka0fQAIrn39jPBUA
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 427ms
253ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: e6f9a07f19020baf5f498208634b1703

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 249ms
83ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 224145
cf-ray: 9472ba878fac7650-LAX
expires: Sun, 01 Jun 2025 02:58:11 GMT
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 527ms
261ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 30 May 2025 02:58:12 GMT
access-control-allow-origin: *
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 138ms
137ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 29 May 2025 03:13:11 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 29 May 2025 02:58:11 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 prbds2s Show response
rtb.gumgum.com/usync/ Frame F52D 0
100 B 299ms
98ms Document
text/plain 35.84.71.42
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://rtb.gumgum.com/usync/prbds2s?gdpr=&gdpr_consent=&us_privacy=1NNY&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dgumgum%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.84.71.42 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-84-71-42.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

content-length: 0
date: Thu, 29 May 2025 02:58:11 GMT
etag: "0d41d8cd98f00b204e9800998ecf8427e"
server: nginx
timing-allow-origin: *

GET
H2 200 AGSKWxUxLCwL0BY3lpX61Rzy-eZ0g7WMNjGsGf6iAz3Ur5UWWI9xv3Qpv3hOq9Fo_jDYUqFtOISOl_ruGNIbS7jN0UZpx_ItSFzlSdA4DwZrV-zoZaMjyqChc33ypwfBp8BMidawcjxvFA== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 172ms
171ms Script
application/javascript 2607:f8b0:4006:80b::200e
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUxLCwL0BY3lpX61Rzy-eZ0g7WMNjGsGf6iAz3Ur5UWWI9xv3Qpv3hOq9Fo_jDYUqFtOISOl_ruGNIbS7jN0UZpx_ItSFzlSdA4DwZrV-zoZaMjyqChc33ypwfBp8BMidawcjxvFA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDg3NDkxLDczMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiZ1BSRDBORmVxNUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwiY3dxZHMuYXdhZHdhdHQuY29tIl0sWzI1LCJbWzMxMDYxNjkwXV0iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3743915b951e714b4984730ceffc290358df729921d100c825c3294be0e7504

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mSyhU1zYCix-lyNV1HalhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw1pBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F4zcZbrFuBuEn7NmsXEJv53Wa1A2IhHo7Ds-4fZBPYsOV6F7OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGpkbmegXF8gQEA9UdEzA"
content-security-policy: script-src 'report-sample' 'nonce-mSyhU1zYCix-lyNV1HalhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 464ms
145ms XHR
application/json 2606:ae80:1471:17::1140
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1471:17::1140 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 29 May 2025 03:28:12 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 258ms
90ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10c0d08c9ddb0dece1c1a2499d1b9a6913d43283165ccbcfcbe0911273000af3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 10971
cf-ray: 9472ba898c1f08aa-LAX
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 28 May 2025 19:55:37 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
95 B 294ms
123ms Image
image/gif 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&halo_id=060ixefju6a659b66666666666666666666uomowi0e0y6g000000000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba898c962abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 300ms
99ms Image
text/html 52.26.97.238
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.26.97.238 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-26-97-238.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&adnxs_id=1564310468653297776&gdpr=0

43 B
95 B

120ms
120ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&adnxs_id=1564310468653297776&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8a3d6d2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&adnxs_id=1564310468653297776&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: a9b6645a-c4a4-41c6-8116-3cc34b24d125
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:12 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748487492-TUYXKLUS-3JEI%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748487492-TUYXKLUS-3JEI%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=e8ee35e5-ef82-4cd4-bdda-d10f0b3ea490&id=AU1D-0100-001748487492-TUYXKLUS-3JEI&auid=AU1D-0100-001748487492-TUYXKLUS-3JEI

43 B
95 B

118ms
118ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=e8ee35e5-ef82-4cd4-bdda-d10f0b3ea490&id=AU1D-0100-001748487492-TUYXKLUS-3JEI&auid=AU1D-0100-001748487492-TUYXKLUS-3JEI
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8bcf4d2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=e8ee35e5-ef82-4cd4-bdda-d10f0b3ea490&id=AU1D-0100-001748487492-TUYXKLUS-3JEI&auid=AU1D-0100-001748487492-TUYXKLUS-3JEI
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:11 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748487492-TUYXKLUS-3JEI
https://image2.pubmatic.com/AdServer/UCookieSetPug?ird=1&rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748487492-TUYXKLUS-3JEI
https://ids.ad.gt/api/v1/pbm_match?pbm=41087F52-A0BD-4E18-B356-E4A8E51A75FB&id=AU1D-0100-001748487492-TUYXKLUS-3JEI

43 B
95 B

127ms
126ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=41087F52-A0BD-4E18-B356-E4A8E51A75FB&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8d797b2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=41087F52-A0BD-4E18-B356-E4A8E51A75FB&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:12 GMT
server: nginx

GET
H/1.1 204
No Content token
token.rubiconproject.com/ 0
1 KB 401ms
130ms Image
text/plain 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001748487492-TUYXKLUS-3JEI&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4581d8330ee81d8f36e15dba6d5b7f41
Pragma: no-cache

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748487492-TUYXKLUS-3JEI&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=0a831894-4f5b-4a69-a2cf-c9858718c72e&id=AU1D-0100-001748487492-TUYXKLUS-3JEI

43 B
170 B

188ms
118ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=0a831894-4f5b-4a69-a2cf-c9858718c72e&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba898c9f2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=0a831894-4f5b-4a69-a2cf-c9858718c72e&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
content-length: 259
date: Thu, 29 May 2025 02:58:11 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001748487492-TUYXKLUS-3JEI&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748487492...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001748487492-TUYXKLUS-3JEI&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=d1ca0760-acbf-4272-b206-fb1259382ab3%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&ttd_puid=d1ca0760-acbf-4272-b206-fb1259382ab3%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&tapad_id=d1ca0760-acbf-4272-b206-fb1259382ab3

43 B
95 B

131ms
130ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&tapad_id=d1ca0760-acbf-4272-b206-fb1259382ab3
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8d99b02abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&tapad_id=d1ca0760-acbf-4272-b206-fb1259382ab3
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
243 B 153ms
152ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001748487492-TUYXKLUS-3JEI

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:11 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001748487492-TUYXKLUS-3JEI
https://ids.ad.gt/api/v1/amo_match?turn_id=3135167154967913612&id=AU1D-0100-001748487492-TUYXKLUS-3JEI

43 B
94 B

155ms
120ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=3135167154967913612&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba898c9b2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=3135167154967913612&id=AU1D-0100-001748487492-TUYXKLUS-3JEI
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 02:58:11 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&uid=3bc79684-ea48-4d0c-b15f-1628c5d7aea9&gdpr=0

43 B
95 B

120ms
119ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&uid=3bc79684-ea48-4d0c-b15f-1628c5d7aea9&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8cc88e2abd-LAX
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748487492-TUYXKLUS-3JEI&uid=3bc79684-ea48-4d0c-b15f-1628c5d7aea9&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 29 May 2025 02:58:12 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-161
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001748487492-TUYXKLUS-3JEI
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQ4NzQ5Mi1UVVlYS0xVUy0zSkVJ

170 B
188 B

150ms
149ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQ4NzQ5Mi1UVVlYS0xVUy0zSkVJ

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 9472ba8a4d8d2abd-LAX
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODQ4NzQ5Mi1UVVlYS0xVUy0zSkVJ
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2

200

cm Show response
u.openx.net/w/1.0/ Frame 5E15
Redirect Chain

https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gd...
https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx...

943 B
1 KB

97ms
96ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 0f6ff0cec8713218aba9520391aebe18b0e7862182baf75818b5bc839e9d1cbc

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 943
content-type: text/html
date: Thu, 29 May 2025 02:58:11 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 29 May 2025 02:58:11 GMT
location: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 219ms
218ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

bd98fa71c0dff44139cafec2a011da852db8a677a375dbf8cda04ee70a0ea5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 844ms
683ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 8e840ad9fd60a729533e11d46e32bb315b36b5fa6e9b8c748deec709b49ccc89

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
x-cloud-trace-context: 41a2f6194e6778b6c3e8e64a353a0eb4
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 219ms
217ms Fetch
text/plain 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 695ms
225ms Fetch
application/json 2001:41d0:701:1000::1291
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::1291 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: 01494ebda4be4fa213fb4cdd0de13daa06bf9ea8acf9ffa89e4fbdf52a3421a0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 218ms
218ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:11 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
114 KB 154ms
154ms Script
application/javascript 142.250.80.40
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.40 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

69bc5b0f9a80149443858e10d4c46969bad7bf12bcb21c137033e96d2d41ca4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 02:58:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 116659
x-xss-protection: 0
server: Google Tag Manager

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 297ms
122ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 9472ba8b4e2c2b74-LAX
date: Thu, 29 May 2025 02:58:12 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 170ms
169ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8a2b442b8b-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 289ms
120ms Script
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba8b5b91cb7d-LAX
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:12 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 846 B
259 B 124ms
122ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dbd8e090c7d4dccfa1290361c5952c718b36530d84cebfa758af3e57972f83fc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 9472ba8c0ee92b74-LAX
access-control-allow-origin: *
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 138ms
137ms Script
application/javascript 184.31.72.66
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.31.72.66 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-31-72-66.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 29 May 2025 03:13:12 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 29 May 2025 02:58:12 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H3 200 setuid
prebid.intergient.com/ Frame 5E15 0
837 B 235ms
159ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=f9f44c08-e022-429e-9996-98d8c49e8734
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487492&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=qpm%2BlUC7eq6fA9At6jSmnYEuKYLt3%2FH3CDClRDi%2BGgU%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487492&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=qpm%2BlUC7eq6fA9At6jSmnYEuKYLt3%2FH3CDClRDi%2BGgU%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9472ba8b7d04c213-LAX
server: cloudflare

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 5E15 170 B
409 B 431ms
152ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 5E15 170 B
232 B 430ms
153ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=ZWM0NTEwMGQtOTBjYS0yZmQzLWU3ZmEtMDI3NDhmMjc4YmQ5

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:12 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5E15
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=c02ac3c7-59bd-7177-f21a-58cd45c545b9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a831894-4f5b-4a69-a2cf-c9858718c72e&ttd_puid=c02ac3c7-59bd-7177-f21a-58cd45c545b9&gdpr=0&gdpr_consent=

43 B
239 B

121ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a831894-4f5b-4a69-a2cf-c9858718c72e&ttd_puid=c02ac3c7-59bd-7177-f21a-58cd45c545b9&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=0a831894-4f5b-4a69-a2cf-c9858718c72e&ttd_puid=c02ac3c7-59bd-7177-f21a-58cd45c545b9&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 29 May 2025 02:58:12 GMT
server: Kestrel

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 5E15
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/54eda583-c911-e33e-c3cd-4e38ba9288f0?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-kO5RW8xE2p.bIScvPY.g73QW8lg2LbjOwBg-~A

43 B
97 B

96ms
96ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-kO5RW8xE2p.bIScvPY.g73QW8lg2LbjOwBg-~A
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-kO5RW8xE2p.bIScvPY.g73QW8lg2LbjOwBg-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 5E15
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDfNRAALp6x-NgA_

85 B
195 B

223ms
223ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDfNRAALp6x-NgA_
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748487493.174894,VS0,VE0
age: 2824
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/png
x-served-by: cache-toj-leto2350021-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 1935

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDfNRAALp6x-NgA_
x-timer: S1748487493.855880,VS0,VE94
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT
x-served-by: cache-toj-leto2350021-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 5E15
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3135167154967913612&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

96ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3135167154967913612&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?cc=1&id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3135167154967913612&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 02:58:30 GMT

GET
H3 200 ad.php Show response
fundingchoicesmessages.google.com/f/AGSKWxWSZODoFubB1E5GPInO-VXupSxt0LDx4DSC2FA9TQUi9hOm3-ygq-3E55T8IRU9-Fx1WDP3_NP-LE_3Zr7pMhxnCJLgisnHujvS0mG4WO81z-w-ub7KW4tAvp-VlHTQVDQ3WxIw_mwTZnut_3sbG7aZn7o3Q... 54 B
109 B 164ms
163ms Script
application/javascript 142.250.80.14
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWSZODoFubB1E5GPInO-VXupSxt0LDx4DSC2FA9TQUi9hOm3-ygq-3E55T8IRU9-Fx1WDP3_NP-LE_3Zr7pMhxnCJLgisnHujvS0mG4WO81z-w-ub7KW4tAvp-VlHTQVDQ3WxIw_mwTZnut_3sbG7aZn7o3QyLyEcZv1YGtpsElAgH_CctRSEZ2Xxpq/_/adgalleryheader./adw3./ad.php?/slider.ad./delivery/ag.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

191fe791169ade53975feeeb6190e4cfca3f2b028d115cdfe7bb654f993c4555

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Hxis8r23kHq_u44zyhUZVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmJw1ZBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F4zcZbrFuBuEn7NmsXEJv53Wa1A2IhHo4js-4fZBOYserFZiYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwNTI3M9A-P4AgMA9U5E3g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-Hxis8r23kHq_u44zyhUZVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 show_companion_ad.js Show response
pagead2.googlesyndication.com/pagead/ 40 KB
15 KB 407ms
136ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_companion_ad.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

055545ec4c1e204e191b7ff91e6195763af05a8b11862536770b1973c7e872b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5823782017674029676
age: 2643
x-content-type-options: nosniff
expires: Thu, 29 May 2025 03:14:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 02:14:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 15063
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxWMemZgXexFyEX-Kn0i3wXOUlJBxFqkDBk4hbRbq03PtWFe7zfgliH2I4D7HqPAaEns38YHS40o9VwVmoQ6y704e-gDBz4E94HZ9coFNGcUUUjjSIe7N-oCPcvgBCFBHqX9JCuJ5A== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 305ms
161ms XHR
text/html 142.250.80.14
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWMemZgXexFyEX-Kn0i3wXOUlJBxFqkDBk4hbRbq03PtWFe7zfgliH2I4D7HqPAaEns38YHS40o9VwVmoQ6y704e-gDBz4E94HZ9coFNGcUUUjjSIe7N-oCPcvgBCFBHqX9JCuJ5A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4kRJxRvoi8lxkSrSZ1QvPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0ZBi-FB_mfUHEJv53Wa1A2IhHo4js-4fZBNYcezvdyYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSuZ2AeX2AAAMalKB8"
content-security-policy: script-src 'report-sample' 'nonce-4kRJxRvoi8lxkSrSZ1QvPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame A640 5 KB
2 KB 257ms
90ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 1341
apigw-requestid: LTuODjuYPHcEPJg=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 9472ba8de8e4dba6-LAX
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 02:58:12 GMT
last-modified: Thu, 29 May 2025 02:18:27 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 130 KB
45 KB 542ms
541ms Fetch
text/plain 142.250.64.98
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=7887852181924918&correlator=503411326393092&eid=31090592%2C31090594%2C31092627%2C31092679%2C95353384%2C83321073%2C31061690&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&us_privacy=1NNY&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1748487492639&lmt=1748487492&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fcwqds.awadwatt.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1Kkt1ZzVkQ3ZHc2ttVjRldHplVGRIRHpBb0daYkRucUVidHdJM19rWUNzNDhleW0yb2NucWxNLTgxSHdvSnBoX1pYARI0CgpwdWJjaWQub3JnEiQ0YjIzMzg1MC00ZjFmLTRmZjgtYmFlMC04YmRlNTkzYjM1NzBYARIdCg5lc3AuY3JpdGVvLmNvbRjmn-fP8TJIAFICCGQSGAoJeWFob28uY29tGOqj58_xMkgAUgIIbxIXCghydGJob3VzZRjmn-fP8TJIAFICCGQSFAoFb3BlbngY1qHnz_EySABSAghvEhsKDDMzYWNyb3NzLmNvbRjmn-fP8TJIAFICCGQShwEKDmxpdmVpbnRlbnQuY29tEnMxNi1IeUpBZzFyQ05YSjBTWVA2YkZTb3JnRVJWTldjS3pzNVhENkhseEZYdVJvWDJTZEpod1I3RVdSeHh0U1JCNnZxK1hwMjRncjRSMnFWQjgrMlRGTVhyRTlnV1VvU2YzWlpTTXdzQ0p4a01BS2VIZz09WAE.&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1748487489098&idt=1548&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D5edf599474f5407e98a407c18985437a87490813%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fcwqds.awadwatt.com%252F%26tyche_code%3DV.20250528.1%26pageos_code%3DV.20250528.1%26config_id%3D1024872_74068_primary_config%26hour%3D16%26day%3DWednesday%26referrer_domain%3Dcwqds.awadwatt.com%26OS%3DLinux%2520null%26browser%3DChrome%2520137%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250528.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=9948&tan=bcd3cb43-b3ce-40ff-a0ff-3ba3e1c86b73&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.64.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e69d783b5eb252f5e17155ebc1e3a803788a62d53142a45e00b03096b915f16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 46116
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 074F 7 KB
3 KB 434ms
149ms Document
text/html 142.251.41.1
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:58:13 GMT
expires: Thu, 29 May 2025 02:58:13 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWMemZgXexFyEX-Kn0i3wXOUlJBxFqkDBk4hbRbq03PtWFe7zfgliH2I4D7HqPAaEns38YHS40o9VwVmoQ6y704e-gDBz4E94HZ9coFNGcUUUjjSIe7N-oCPcvgBCFBHqX9JCuJ5A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Vsu4k4kVhjOwvheyN25EnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:12 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0pBi-FB_mfUHEJv53Wa1A2IhHo4js-4fZBP4set1A7OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLXMzCPLzAAALN6J9k"
content-security-policy: script-src 'report-sample' 'nonce-Vsu4k4kVhjOwvheyN25EnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 219ms
218ms XHR
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

61e2279d88202a37f01d71d57fdee917f67f5edbd17b5a0cf661fd732379fdc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json
vary: Origin

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
34 B 185ms
183ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 9472ba90386e0918-LAX
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:13 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 262ms
116ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9472ba8f7f910918-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:13 GMT
server: cloudflare
vary: Origin

POST
H2 204 event
p.ad.gt/api/v1/ Frame A640 0
140 B 268ms
123ms Ping
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 9472ba911fdd2ae9-LAX
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 02:58:13 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 255ms
112ms Preflight
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: POST, OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 9472ba8f7f90e57c-LAX
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:13 GMT
server: cloudflare
vary: Origin

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 6D85 1 KB
2 KB 362ms
141ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 4110ef985947471f2ad1b30e8de1009c4bee6fe6092a9b1c50c7f74181c9a4c9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1235
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:13 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWMemZgXexFyEX-Kn0i3wXOUlJBxFqkDBk4hbRbq03PtWFe7zfgliH2I4D7HqPAaEns38YHS40o9VwVmoQ6y704e-gDBz4E94HZ9coFNGcUUUjjSIe7N-oCPcvgBCFBHqX9JCuJ5A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KiD_6H1xc-bZKDxr1rGGCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw0JBi-FB_mfUHEJv53Wa1A2Ihbo6js-4fZBM40LVFR8klKb8wPjk_ryQ1r0Q3MaVYF8QuykwqLckvQmGnloFU5OSnp2fmpccbGRiZGpgamesZmMcXGAAAYbcm6Q"
content-security-policy: script-src 'report-sample' 'nonce-KiD_6H1xc-bZKDxr1rGGCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWMemZgXexFyEX-Kn0i3wXOUlJBxFqkDBk4hbRbq03PtWFe7zfgliH2I4D7HqPAaEns38YHS40o9VwVmoQ6y704e-gDBz4E94HZ9coFNGcUUUjjSIe7N-oCPcvgBCFBHqX9JCuJ5A==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-N7k-hutcZfVsP7-aNCVV3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw1ZBi-FB_mfUHEJv53Wa1A2Ihbo6js-4fZBN48H26rpJLUn5hfHJ-XklqXoluYkqxLohdlJlUWpJfhMJOLQOpyMlPT8_MS483MjAyNTA1MtczMI8vMAAAgPYnVw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-N7k-hutcZfVsP7-aNCVV3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxUTqscHTu0lJOOeLmQJKgZY_fcjf15ADShzxVhZbHGCaRuzqJJ2PkZi079D9cC_AgTDXPeO81oBfz3KOjqX5HH4n0Um-czjRBe03Ag6j8OJECnvjMevIcKk0LOV1MZEAFjr_TeFrw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 207ms
207ms Script
application/javascript 142.250.80.14
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUTqscHTu0lJOOeLmQJKgZY_fcjf15ADShzxVhZbHGCaRuzqJJ2PkZi079D9cC_AgTDXPeO81oBfz3KOjqX5HH4n0Um-czjRBe03Ag6j8OJECnvjMevIcKk0LOV1MZEAFjr_TeFrw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NDg3NDkzLDEyMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5LDZdLG51bGwsMixudWxsLCJlbiIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLDFdLCJodHRwczovL3BhaW50LnRveXMvb2lsLyIsbnVsbCxbWzgsImdQUkQwTkZlcTVJIl0sWzksImVuLVVTIl0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsImN3cWRzLmF3YWR3YXR0LmNvbSJdLFsyNSwiW1szMTA2MTY5MF1dIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

645b8ff657a7cc612df671ceb6888786e0b1bf87c27fa150542bf264d877963f

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce--bbOHC8F0LId93c875a2xw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:13 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmII0pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjNxlusW4G4Sfs2axcQm_ndZrUDYiFujqOz7h9kE7jx95iTkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkamBqZG5noFxfIEBAKc7P9k"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce--bbOHC8F0LId93c875a2xw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET

id5
match.prod.bidr.io/cookie-sync/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*tVbKcrR4QU8KXxh15om0Ca-W6pBcIFIdKLzE-Nm8QIkeygJTrYTUw1jpX960kKbX&gdpr_consent=undefined&gdpr=false
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/7/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/7/2.gif?puid=1564310468653297776&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=0a831894-4f5b-4a69-a2cf-c9858718c72e&ttl=%%TTL%%
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F5%2F4.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/5/4.gif?puid=d1ca0760-acbf-4272-b206-fb1259382ab3&gdpr=0&gdpr_consent=
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F4%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/4/5.gif?puid=5524f9c2-5e74-4b97-b7b3-1c52f09836d7&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/3/6.gif?puid=u_1ab95b9d-623f-4ce8-9c95-08e6ba6a8280&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F2%2F7.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/2/7.gif?puid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F1%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/483/434/1/8.gif?puid=3bc79684-ea48-4d0c-b15f-1628c5d7aea9&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=

0
0

GET
H3 200 container.html Show response
99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 740B 7 KB
0 0ms
0ms Document
text/html 142.251.41.1
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.1 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f1.1e100.net

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:58:13 GMT
expires: Thu, 29 May 2025 02:58:13 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 0F6D 2 KB
1 KB 386ms
128ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&us_privacy=1NNY&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

5c36563bdbe152010043cf4e53ba9644a3b0547455bbbe1f8a90a451caa4c67d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:58:13 GMT
server: Kestrel
server-processing-duration-in-ticks: 95239
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 sync Show response
eb2.3lift.com/ Frame FCFB 1 KB
2 KB 142ms
141ms Document
text/html 35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: e3486ed9c14a2e20e72a9bbbaf06c4a1b9b340e1ea6fce7b5643de6086e2c91a

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:13 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame A938 0
0 440ms
133ms Document
text/plain 143.244.151.97
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=&gdpr=0&gdpr_consent=&us_privacy=1NNY&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 143.244.151.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 29 May 2025 02:58:13 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame EDFA 269 B
379 B 411ms
135ms Document
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 29 May 2025 02:58:13 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame E395 813 B
1 KB 117ms
94ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: b044b313e91b8547ded9d618ef0d2f7ebd4a9ebfe9a557fbbb24666dd14bb658

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 813
content-type: text/html
date: Thu, 29 May 2025 02:58:13 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 162.245.206.248

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame F327 3 KB
2 KB 225ms
76ms Document
text/html 104.18.24.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.18 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 575
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9472ba91ff65f7d5-LAX
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 02:58:13 GMT
expires: Thu, 29 May 2025 06:58:13 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 200B 52 KB
17 KB 828ms
226ms Document
text/html 23.221.236.135
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.221.236.135 Billerica, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS: a23-221-236-135.deploy.static.akamaitechnologies.com
Software: nginx/1.24.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 29 May 2025 02:58:13 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 30 May 2025 02:58:15 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.24.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame C27C 20 KB
7 KB 122ms
119ms Document
text/html 23.44.17.14
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.44.17.14 Elk Grove Village, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=121033
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 29 May 2025 02:58:13 GMT
expires: Fri, 30 May 2025 12:35:26 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 134ms
130ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=P1-Z5l9VQzhONWgySmMwdXNqOU4yNVAlMkZGRVYyc0o1ekNtbWR2blJHSGUzQlZQNTVhcVNXeFAyOWk2Qk5pdUo4STBDVFJWb1I2YW5iQnRzU084dktKR0p6WDRhTFo1cHY4VEVDUEF6VzhzTHVqMzFaOUR1SVZNNlRtaWJsM2ZsVWM1WUY3&cw=1&pbt=1&lsw=1&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 02:58:12 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 251314
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 219ms
216ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
660 B 137ms
132ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: cccc0dee981f069bb2a34f5f9097ec919f65407acb788e277b05f39e79c50105

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 100ms
94ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0&us_privacy=1NNY&tp=4bz6IP1fpwdvasfCk1dSuGGHlJp0KK9QsQxLlHX4YJ0%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 8359036c2ca3ff048fb443b6a0fc2e7874b191c5976fc8a3100eafb1a184ffc7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 29 May 2025 02:58:13 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 127 B
0 4ms
4ms Fetch
text/plain 54.88.163.74
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwczkk1jw4dwt9agbvatj1e5&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.88.163.74 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-88-163-74.compute-1.amazonaws.com
Software: /
Resource Hash: d7245f1c43835fc30698458e62200b37eedd3926dfefd3408d2a43e50ae7f3de

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: eb5b747e3543c01f
request-time: 11
access-control-allow-credentials: true
expires: Fri, 30 May 2025 02:58:11 GMT
access-control-allow-origin: https://paint.toys
content-length: 127
date: Thu, 29 May 2025 02:58:11 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
368 B 129ms
128ms Fetch
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: application/json
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 256172
expires: 0
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

GET sync
ssbsync.smartadserver.com/api/ 0
0

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid&us_privacy=1NNY
https://x.bidswitch.net/ul_cb/sync?ssp=themediagrid&us_privacy=1NNY
https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=themediagrid&bsw_custom_parameter=0186438e-8da5-4640-abda-99519b46ab8e
https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=7d4a3984-9aed-4f4d-95ee-0f06b29f3b34&ssp=themediagrid&bsw_param=0186438e-8da5-4640-abda-99519b46ab8e

43 B
103 B

145ms
143ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=7d4a3984-9aed-4f4d-95ee-0f06b29f3b34&ssp=themediagrid&bsw_param=0186438e-8da5-4640-abda-99519b46ab8e
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

Location: https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=7d4a3984-9aed-4f4d-95ee-0f06b29f3b34&ssp=themediagrid&bsw_param=0186438e-8da5-4640-abda-99519b46ab8e
Content-Length: 0
Date: Thu, 29 May 2025 02:58:14 GMT
Connection: keep-alive
Server: Kestrel

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=

68 B
324 B

625ms
132ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

location: https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=
content-length: 323
date: Thu, 29 May 2025 02:58:13 GMT
server: Kestrel

GET

user_sync.html
ads.pubmatic.com/AdServer/js/
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156557&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156557%26pr%3Dhttps%253A%252F%252Fmatch.sharethrough.com%252F...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDEwODdGNTItQTBCRC00RTE4LUIzNTYtRTRBOEU1MUE3NUZC&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QQh_UqC9ThizVuSo5Rp1-w%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

0
0

GET
H2

200

v1
match.sharethrough.com/sync/
Redirect Chain

https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-_jQ037pSmtjhN.gif?idmatch=1&gdpr=0&gdpr_consent=&__qcmcs=1
https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=_bdzyqjrdMjmtnfJ_ettyvq-cM_m7HbL_ewFdWaA

68 B
323 B

170ms
133ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=_bdzyqjrdMjmtnfJ_ettyvq-cM_m7HbL_ewFdWaA

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-13-217-140-8.compute-1.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

strict-transport-security: max-age=86400
cache-control: private, no-store, proxy-revalidate
location: https://match.sharethrough.com/sync/v1?source_id=mKgSocXAVa8Wq7r1ivjrQDkr&gdpr=0&source_user_id=_bdzyqjrdMjmtnfJ_ettyvq-cM_m7HbL_ewFdWaA
content-length: 0
date: Thu, 29 May 2025 02:58:13 GMT

GET
H2

200

ibs:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=1NNY&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e

42 B
717 B

145ms
144ms

Image
image/gif

13.217.140.8
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

13.217.140.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-0c19462f0.edge-va6.demdex.com 11 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: mEELl3JwSn0=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=0a831894-4f5b-4a69-a2cf-c9858718c72e
content-length: 189
date: Thu, 29 May 2025 02:58:13 GMT
server: Kestrel

GET
H2 200 158
match.deepintent.com/usersync/ 0
339 B 420ms
129ms Image
image/gif 169.197.150.8
DEEPINTENT

General

Check archive.org

Download Go to Show image

Full URL: https://match.deepintent.com/usersync/158
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif
server: a

POST
H3 204 AGSKWxV7zwyRiMajzNlAY7-0L-LYCXXNImB_S6Y_LP-oDi07OcCPSCHQfVkIl9FsQ2G6qKVxlw2GgGPPHXoDoLX7vfwE6mvBq_-uSm-dkJb9BoYnf34jCWtUKKKoc9Ls5XS9hWKHB-d0hg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 184ms
183ms XHR
text/html 142.250.80.14
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxV7zwyRiMajzNlAY7-0L-LYCXXNImB_S6Y_LP-oDi07OcCPSCHQfVkIl9FsQ2G6qKVxlw2GgGPPHXoDoLX7vfwE6mvBq_-uSm-dkJb9BoYnf34jCWtUKKKoc9Ls5XS9hWKHB-d0hg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AoyrtD0jBrDO2PR4AtLYRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1JBi-FB_mfUHEJv53Wa1A2IhHo6js-4fZBN4cbltB6OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLXMzCPLzAAAKuSJ7s"
content-security-policy: script-src 'report-sample' 'nonce-AoyrtD0jBrDO2PR4AtLYRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 11CB 652 B
254 B 432ms
156ms Document
text/html 142.250.65.194
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiYyO60AjAB&v=APEucNWl5BCRE7nacUEXblbhRbcM8SCRIQa88kvvHax1bIvuOuUagecjKK49vPf7pr_cRVXvCVu1W_R-E6cBdc6AQPGVAn0A3YXgcxYHnHMDokBJajPStx8

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f2.1e100.net

Software

cafe /

Resource Hash

8c04e118bdd5757192be2a1eb360786f9fa1c4b398806430b7f41f203f64d8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:58:13 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK dvbm.js Show response
cdn.doubleverify.com/ Frame 740B 478 KB
96 KB 452ms
145ms Script
text/javascript 2600:141b:1c00:44::17db:244a
AKAMAI-ASN1 Akama...

General

Check archive.org

Download Go to

Full URL: https://cdn.doubleverify.com/dvbm.js
Requested by: Host: cwqds.awadwatt.com
URL: https://cwqds.awadwatt.com/ahffwiczhnpomkoswxgbswRaXhsTm9GVUhpaVZYUkZ2OEFraXotMzE3NS0yNjcyMDg3OC0wZmVhMDI3OS00OTIxLVFacmpLdW1GS3ozdXNNSHJnSnpR/bp1802x4jtps99xfoqcm370kg1d9jd/jebugcobgxgjvjghjrgyse/eh5gwow2nv2hl
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:44::17db:244a Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software: /
Resource Hash: 81688a891776d416b6f7139ab4fb8a9fdb04db0ba4c2ebd30a08385d4c657678

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

Access-Control-Expose-Headers: *
Cache-Control: max-age=900
Content-Encoding: br
ETag: "bb29df7e62d6c9246cf7f017e937334b"
Connection: keep-alive
Expires: Thu, 29 May 2025 03:13:13 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Length: 97461
Date: Thu, 29 May 2025 02:58:13 GMT
Last-Modified: Wed, 28 May 2025 18:05:04 GMT
Content-Type: text/javascript

GET
H2 200 express_html_inpage_rendering_lib_200_281.js Show response
s0.2mdn.net/879366/ Frame 740B 117 KB
41 KB 417ms
134ms Script
text/javascript 2607:f8b0:4006:81e::2006
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d116b21c9ac496c162f9074c75ce227719d025422a1794a57f497718f87cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Origin: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 42108
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 29 May 2025 15:16:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 15:16:25 GMT
last-modified: Tue, 29 Oct 2024 21:00:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 41319
x-xss-protection: 0
server: sffe

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250527/r20110914/elements/html/ Frame 740B 8 KB
3 KB 638ms
366ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250527/r20110914/elements/html/omrhp_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 567199331036499589
age: 30793
x-content-type-options: nosniff
expires: Wed, 11 Jun 2025 18:25:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 18:25:00 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20250527/r20110914/ Frame 740B 21 KB
8 KB 610ms
347ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250527/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be507b359cc4919d2c1154e11c9d17b94ba03bc583f0d31fffc3525583bec00d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 5251608839672234903
age: 30867
x-content-type-options: nosniff
expires: Wed, 11 Jun 2025 18:23:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 18:23:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8642
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 740B 41 KB
14 KB 436ms
152ms Script
text/javascript 2607:f8b0:4006:820::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2731
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 29 May 2025 03:02:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:12:42 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250527/r20110914/client/ Frame 740B 3 KB
1 KB 550ms
268ms Script
text/javascript 2607:f8b0:4006:820::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250527/r20110914/client/window_focus_fy2021.js

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 31204
x-content-type-options: nosniff
expires: Wed, 11 Jun 2025 18:18:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 18:18:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 36B5 1 KB
643 B 396ms
137ms Document
text/html 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 46071
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 14:10:22 GMT
etag: 48472445140208031
expires: Thu, 29 May 2025 14:10:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250527/r20110914/client/ Frame 740B 19 KB
8 KB 416ms
135ms Script
text/javascript 2607:f8b0:4006:820::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250527/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

760e5d0b97d6707a3d5c2c949bd70e7668484a144f383f3a4dfa878bad15e8ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 3000748235154339481
age: 31204
x-content-type-options: nosniff
expires: Wed, 11 Jun 2025 18:18:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 28 May 2025 18:18:09 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 740B 42 B
63 B 629ms
369ms Image
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Awq998yYz04lxZ6VnacdvYzP9KgTaC4dRBIwvU05P3mxM9yyVhqGZtk0pe1JapW4jqstJRBXD-P6tkdamMUySg0JY1embqp3y3LnDVMVfgH79Zudk

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET l
www.google.com/ads/measurement/ Frame 740B 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 740B 221 KB
68 KB 396ms
137ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db9772412ddfb6a667eaedb6ee473ab3d9a855633fae513f3ee343dfc6de5580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 12739314704981603380
age: 2487
x-content-type-options: nosniff
expires: Thu, 29 May 2025 03:16:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 02:16:46 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69733
x-xss-protection: 0
server: cafe

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D85
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

145ms
145ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 29 May 2025 02:58:13 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 6D85 170 B
232 B 152ms
151ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 6D85
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D

170 B
232 B

152ms
152ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D

Requested by

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-6-35-76.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 6D85
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

142ms
142ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 6D85 0
248 B 357ms
136ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1909227180460624593624&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 880210E255CB426DAB500E465759B6D1 Ref B: LAX311000108049 Ref C: 2025-05-29T02:58:13Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2PXfzbOSzcd1u3+AoRA==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT

GET
H/1.1

200
OK

throtle
match.prod.bidr.io/cookie-sync/ Frame 6D85
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1909227180460624593624
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=22042997-2afd-4674-b47a-e7ef780b67cb&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=22042997-2afd-4674-b47a-e7ef780b67cb&vxii_pid=12&vxii_pid1=7006&vxii_rcid=b5f15f2b-c23b-45cd-8804-5d47f0876213&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=MgoQMWusXnRTIiMc0uYG6KL1zvg&_t=1748487494
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=016020f6-8fbb-4f6b-90c3-71766bf018a4
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=0a831894-4f5b-4a69-a2cf-c9858718c72e
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-xs.Tp3JE2oSmgVKwgc5KZArO3BN2_TJkoWl3bw--~A
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D4%26_t%3D1748487495
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1564310468653297776&vxii_ts=4&_t=1748487495
https://match.prod.bidr.io/cookie-sync/throtle?

43 B
433 B

250ms
141ms

Image
image/gif

52.6.35.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/throtle?

Requested by

Protocol

HTTP/1.1

Server

52.6.35.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains
cache-control: no-cache, must-revalidate
pragma: no-cache
Connection: keep-alive
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
Content-Length: 43
Date: Thu, 29 May 2025 02:58:16 GMT
content-type: image/gif
Server: gunicorn

Redirect headers

location: https://match.prod.bidr.io/cookie-sync/throtle?
content-length: 70
p3p: CP="NOI OUR BUS UNI COM NAV"
date: Thu, 29 May 2025 02:58:16 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D85
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1909227180460624593624?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883

37 B
474 B

145ms
145ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 02:58:13 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 6D85 42 B
691 B 327ms
101ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1909227180460624593624&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: B98E8D66219A463C88AA2B03CD1388D9 Ref B: LAX311000114017 Ref C: 2025-05-29T02:58:13Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D85
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=12f8cc65338b0697&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW39zgJC79PvAQEBAQEBAQCWGPjYrAEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

145ms
145ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW39zgJC79PvAQEBAQEBAQCWGPjYrAEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW39zgJC79PvAQEBAQEBAQCWGPjYrAEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 6D85
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430

37 B
474 B

146ms
144ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Content-Length: 141
Date: Thu, 29 May 2025 02:58:13 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame 6D85 0
898 B 152ms
151ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=1909227180460624593624
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=1NNY&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487493&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=V7NYZ4KmA8mt8rMmke98NR%2BnHOl%2FMOcI1smEJOru%2Ff8%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487493&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=V7NYZ4KmA8mt8rMmke98NR%2BnHOl%2FMOcI1smEJOru%2Ff8%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9472ba919970c213-LAX
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E395
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1564310468653297776

43 B
61 B

99ms
99ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=1564310468653297776
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=1564310468653297776
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 578548ae-c07d-4c23-9708-09526542ac96
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame E395
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=946853e6-ab49-4548-b158-45ac25da0a4c
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=946853e6-ab49-4548-b158-45ac25da0a4c

42 B
318 B

120ms
117ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=946853e6-ab49-4548-b158-45ac25da0a4c
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=946853e6-ab49-4548-b158-45ac25da0a4c
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame E395 95 B
765 B 245ms
99ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=c7d05f7c-3d09-4eaf-a4c0-5d892fcdaa98

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E395
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=66b82463-e1cc-4b9e-bd77-9eb179e7860d-6837cd45-5553&gdpr=0&gdpr_consent=

43 B
61 B

95ms
95ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=66b82463-e1cc-4b9e-bd77-9eb179e7860d-6837cd45-5553&gdpr=0&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=66b82463-e1cc-4b9e-bd77-9eb179e7860d-6837cd45-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 29 May 2025 02:58:13 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E395
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=709babdd-d9a2-4d24-a7ff-cc649df9f277

43 B
61 B

97ms
96ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=709babdd-d9a2-4d24-a7ff-cc649df9f277
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: e653fd37-f0b7-46f3-98b0-11e3a4dbb85e
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=709babdd-d9a2-4d24-a7ff-cc649df9f277
Content-Length: 112
Date: Thu, 29 May 2025 02:58:14 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame E395
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=HvimvM-IygYIVYnoz1hRLg==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

99ms
98ms

Image
image/gif

35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd?us_privacy=1NNY
Protocol: H2
Server: 35.227.252.103 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 162.245.206.248
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

xuid
eb2.3lift.com/ Frame FCFB
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

192ms
144ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=0a831894-4f5b-4a69-a2cf-c9858718c72e&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 29 May 2025 02:58:13 GMT
server: Kestrel

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame FCFB 170 B
232 B 239ms
153ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FCFB
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D

170 B
188 B

165ms
153ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame FCFB
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTkwOTIyNzE4MDQ2MDYyNDU5MzYyNA%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

142ms
142ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame FCFB 0
144 B 423ms
134ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1909227180460624593624&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 4A5019EFEA494A77AE22A8B0855BE19F Ref B: LAX311000108049 Ref C: 2025-05-29T02:58:13Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2PXf1iS3c+fXJeI2TGg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 02:58:12 GMT

GET
H2

200

sync
thrtle.com/ Frame FCFB
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1909227180460624593624
https://thrtle.com/sync?vxii_pid=7006&vxii_pdid=22042997-2afd-4674-b47a-e7ef780b67cb&us_privacy=1YN-
https://thrtle.com/sync?_reach=1&vxii_pdid=22042997-2afd-4674-b47a-e7ef780b67cb&vxii_pid=12&vxii_pid1=7006&vxii_rcid=016020f6-8fbb-4f6b-90c3-71766bf018a4&vxii_rmax=3
https://sync.srv.stackadapt.com/sync?nid=throtle
https://thrtle.com/sync?vxii_pid=5044&vxii_pdid=MgoQMWusXnRTIiMc0uYG6KL1zvg&_t=1748487494
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=016020f6-8fbb-4f6b-90c3-71766bf018a4
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=0a831894-4f5b-4a69-a2cf-c9858718c72e
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-xs.Tp3JE2oSmgVKwgc5KZArO3BN2_TJkoWl3bw--~A
https://ib.adnxs.com/getuid?https%3A%2F%2Fthrtle.com%2Fsync%3Fvxii_pid%3D5006%26vxii_pdid%3D%24UID%26vxii_ts%3D4%26_t%3D1748487495
https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1564310468653297776&vxii_ts=4&_t=1748487495

43 B
537 B

136ms
134ms

Image
image/gif

52.45.182.175
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1564310468653297776&vxii_ts=4&_t=1748487495
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 52.45.182.175 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-182-175.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Thu, 29 May 2025 02:58:16 GMT
content-type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://thrtle.com/sync?vxii_pid=5006&vxii_pdid=1564310468653297776&vxii_ts=4&_t=1748487495
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 89ee58e9-c81e-419d-b069-b41827f1be6b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

xuid
eb2.3lift.com/ Frame FCFB
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1909227180460624593624?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883

37 B
474 B

155ms
143ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-1HGXOqxE2oQe2IrEvu_7sR8UvDhpHcpkym3Qr.E9ZA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 02:58:13 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame FCFB 42 B
287 B 359ms
100ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1909227180460624593624&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "4e99546d1bc4db1:0"
x-msedge-ref: Ref A: E5F66C33A7D643A3ADD7D7A236AAB348 Ref B: LAX311000114017 Ref C: 2025-05-29T02:58:13Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 29 May 2025 02:58:12 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:41 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame FCFB
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=6e2347282e090697&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW390AIjamb4AQEBAQEBAQCWGPjbPQEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

145ms
144ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW390AIjamb4AQEBAQEBAQCWGPjbPQEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQAN4ExrVW390AIjamb4AQEBAQEBAQCWGPjbPQEBAQEBAQEB&expiration=1748573894&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame FCFB
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430

37 B
474 B

144ms
142ms

Image
image/gif

35.71.139.29
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?us_privacy=1NNY&
Protocol: H2
Server: 35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-320a1031-6bac-5e74-5322-231cd2e606e8$ip$162.245.206.248&dongle=4430
Content-Length: 141
Date: Thu, 29 May 2025 02:58:13 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame C27C 5 KB
6 KB 580ms
135ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=13264564&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 42a5d8480643b37c4ec1414c9a0c854e18c69445362b3ce4996adfaae7466496

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 02:58:13 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 218ms
217ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f9644de09906ff7b61ff5216efd323a7f59c4a43554522fb3ad5149b483fb7f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 02:58:12 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 293ms
150ms Fetch
text/html 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.217.165.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: lax30s03-in-f2.1e100.net
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 220ms
219ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

1e4f73be4e519fbec7b13230160cb67f2414d6726a20d0b27a14f45aafb2541d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 02:58:13 GMT
content-type: application/json
vary: Origin

GET
DATA 200
OK truncated
/ Frame 740B 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2907531e694839d99a220037f6b127dfbbc127f6e6158522f69f3982a2db785

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame EDFA 44 KB
11 KB 136ms
136ms Script
text/html 23.200.198.128
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.198.128 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-198-128.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 2e0ff1c50b69c8f073a24f7d55a7b4d9e17dd2d072eb9365c1ba7924494d6dd1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1NNY

Response headers

cache-control: max-age=78879
content-encoding: gzip
expires: Fri, 30 May 2025 00:52:52 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11450
date: Thu, 29 May 2025 02:58:13 GMT
last-modified: Thu, 29 May 2025 00:52:52 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 11CB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1

43 B
337 B

92ms
92ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiYyO60AjAB&v=APEucNWl5BCRE7nacUEXblbhRbcM8SCRIQa88kvvHax1bIvuOuUagecjKK49vPf7pr_cRVXvCVu1W_R-E6cBdc6AQPGVAn0A3YXgcxYHnHMDokBJajPStx8
Protocol: H2
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=97%2F8tUNOQU4c0qH7gkZOkS1xm24D2lz58uKC%2BZkAyjgWiKuBQHGCpHOi6oM5XQK0ZtEO4F6P9PvkZ9q0SZ7VfD4kiO6cMdYixb84aaUOmH4IZp5n594ZZdvurQI9utnPh%2FVdcDytLDYoJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9472ba96af39dbe1-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept-Encoding
server: cloudflare

Redirect headers

cache-control: no-cache
location: /rum?cm_dsp_id=45&external_user_id=&google_error=15&gdpr=0&C=1
cf-cache-status: DYNAMIC
pragma: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3wybwjpoiw6zWvsxqZdl0ymWrZZ9BWl%2BZt0T4KlbMXcCs%2F52TF9GoAwVSv4gBRZN0KtuVSBi4QU1Siw%2B%2BJCwgEGdIQpM7%2FRu1nEGxyapgqolVO09G3rca%2Br5lTttmyxmIBGNKd5Y9n2ulw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 9472ba961e97dbe1-LAX
expires: 0
alt-svc: h3=":443"; ma=86400
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 11CB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aDfNRtHM4pAAEw3yBdYRjgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15

43 B
805 B

98ms
97ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiYyO60AjAB&v=APEucNWl5BCRE7nacUEXblbhRbcM8SCRIQa88kvvHax1bIvuOuUagecjKK49vPf7pr_cRVXvCVu1W_R-E6cBdc6AQPGVAn0A3YXgcxYHnHMDokBJajPStx8
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jrSfLqL5j89xLVEMs591uQIYrsbNJGztC7BtHnVeoLKWBAuXBFPeCY4yTaN6iwE%2BFI3%2BWe0Zlngiy%2FSeSLjQLhW5bd9XYLXVoX5tybFmm5wRYQDp9Kihf0Nip4ZU%2FKFZ4or%2FXVk%2Bu7GvHg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba9809fe091d-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 288
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 11CB 170 B
188 B 155ms
154ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJzkqAEQi5urARiYyO60AjAB&v=APEucNWl5BCRE7nacUEXblbhRbcM8SCRIQa88kvvHax1bIvuOuUagecjKK49vPf7pr_cRVXvCVu1W_R-E6cBdc6AQPGVAn0A3YXgcxYHnHMDokBJajPStx8

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 11CB
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}&gdpr=0
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU2NDMxMDQ2ODY1MzI5Nzc3Ng%3D%3D&gdpr=0

170 B
188 B

152ms
152ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU2NDMxMDQ2ODY1MzI5Nzc3Ng%3D%3D&gdpr=0

Requested by

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTU2NDMxMDQ2ODY1MzI5Nzc3Ng%3D%3D&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 4d58dc58-2840-426e-99d7-e2da3c15adfe
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_push=AXcoOmR4YBOgIOjEo2rgmCRS5PGrogQnxxM16MR...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZTMwOGY2YjQtMDgwNC00NTE0LTlkYzUtYmZjNDljMzcxM2Zk&google_push=AXcoOmR4YBOgIOjEo2rgmCRS5PGrogQnxxM16MRAGsVyh6SpV-7qRd6xH0ToP...

170 B
188 B

153ms
153ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZTMwOGY2YjQtMDgwNC00NTE0LTlkYzUtYmZjNDljMzcxM2Zk&google_push=AXcoOmR4YBOgIOjEo2rgmCRS5PGrogQnxxM16MRAGsVyh6SpV-7qRd6xH0ToPdxFc2ZNLP0PovUeUcCyOsT4vh2r6iDH2x43sEopjA

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=ZTMwOGY2YjQtMDgwNC00NTE0LTlkYzUtYmZjNDljMzcxM2Zk&google_push=AXcoOmR4YBOgIOjEo2rgmCRS5PGrogQnxxM16MRAGsVyh6SpV-7qRd6xH0ToPdxFc2ZNLP0PovUeUcCyOsT4vh2r6iDH2x43sEopjA
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 36B5 0
164 B 414ms
133ms Image
text/plain 35.174.227.121
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_push=AXcoOmRw7VtW56tGwch1nBpLgnKxG22IihdhAOeZSrL80X5ThQABothIAx3MDSSwB_O-zh2XjzEB63gPBGodrvjpyeCoUfzSX_kd2w
Requested by: Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.227.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-227-121.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

date: Thu, 29 May 2025 02:58:14 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_push=AXcoOmQ5gIyxEEwGhFxRR6oj0ElDoQw_pQ-mLwfD7doM9xospP69imdvjAiXf3dD5DNz2145ikHSLiktT3MIsRqKbk-itSTLUQs70Q
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTM0NDc3ODIzMDc2MDU3MTMxMzc&google_push=AXcoOmQ5gIyxEEwGhFxRR6oj0ElDoQw_pQ-mLwfD7doM9xospP69imdvjAiXf3dD5DNz2145ikHSLiktT3MIsRqKbk-i...

170 B
188 B

155ms
153ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTM0NDc3ODIzMDc2MDU3MTMxMzc&google_push=AXcoOmQ5gIyxEEwGhFxRR6oj0ElDoQw_pQ-mLwfD7doM9xospP69imdvjAiXf3dD5DNz2145ikHSLiktT3MIsRqKbk-itSTLUQs70Q

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTM0NDc3ODIzMDc2MDU3MTMxMzc&google_push=AXcoOmQ5gIyxEEwGhFxRR6oj0ElDoQw_pQ-mLwfD7doM9xospP69imdvjAiXf3dD5DNz2145ikHSLiktT3MIsRqKbk-itSTLUQs70Q
Content-Length: 0
Date: Thu, 29 May 2025 02:58:14 GMT
Server: nginx
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmTXL-RzH-itOwjcSR58AgQneyMC5g5ZRZ_AkeSb0foE2M8xe2E7GO9Vf1-F3w44cylMbMjosEiZ7y...
https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmTXL-RzH-itOwjcSR58AgQneyMC5g5ZRZ_AkeSb0foE2M8xe2E7GO9Vf1-F3w44cylMbMjosEiZ7y1oLlvZJAk8QDw0SU7npQ&google_hm=M2JjNzk2ODQtZWE0OC0...

170 B
188 B

152ms
152ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmTXL-RzH-itOwjcSR58AgQneyMC5g5ZRZ_AkeSb0foE2M8xe2E7GO9Vf1-F3w44cylMbMjosEiZ7y1oLlvZJAk8QDw0SU7npQ&google_hm=M2JjNzk2ODQtZWE0OC00ZDBjLWIxNWYtMTYyOGM1ZDdhZWE5

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, private
location: https://cm.g.doubleclick.net/pixel?google_nid=sonobi&google_push=AXcoOmTXL-RzH-itOwjcSR58AgQneyMC5g5ZRZ_AkeSb0foE2M8xe2E7GO9Vf1-F3w44cylMbMjosEiZ7y1oLlvZJAk8QDw0SU7npQ&google_hm=M2JjNzk2ODQtZWE0OC00ZDBjLWIxNWYtMTYyOGM1ZDdhZWE5
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 29 May 2025 02:58:14 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-161
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=559960&gp=1&google_push=AXcoOmTd7zKFnnhsmOmNV314FD7R4h84VC9VzjcA6UL7ZsysAIMtU-JDUP4WsMS-CZmOPs3bB9cMIhTAn_NEuklzW0dhwYodA0n2ug
https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmTd7zKFnnhsmOmNV314FD7R4h84VC9VzjcA6UL7ZsysAIMtU-JDUP4WsMS-CZmOPs3bB9cMIhTAn_NEuklzW0dhwYodA0n2ug&google_hm=cXhES2xqUV...

170 B
188 B

155ms
155ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmTd7zKFnnhsmOmNV314FD7R4h84VC9VzjcA6UL7ZsysAIMtU-JDUP4WsMS-CZmOPs3bB9cMIhTAn_NEuklzW0dhwYodA0n2ug&google_hm=cXhES2xqUVQyVjhO

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=pulsepoint_inc_&google_push=AXcoOmTd7zKFnnhsmOmNV314FD7R4h84VC9VzjcA6UL7ZsysAIMtU-JDUP4WsMS-CZmOPs3bB9cMIhTAn_NEuklzW0dhwYodA0n2ug&google_hm=cXhES2xqUVQyVjhO
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-7f4779d6c6-94b7q
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-US
server: Jetty(12.0.17)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=google&ssp_init=step1&google_push=AXcoOmQWzd1CpZGN_01anxm5-vUr1rgZFlR9oFN4pzPtbLPMUL4UZkY-_JlzsIT5dUE3kUcCw7ZzcXL_C45bypZivAc6ONE5PppmIr8
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=google&ssp_init=step1&google_push=AXcoOmQWzd1CpZGN_01anxm5-vUr1rgZFlR9oFN4pzPtbLPMUL4UZkY-_JlzsIT5dUE3kUcCw7ZzcXL_C45bypZivAc6ONE5PppmIr8
https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=DW3ZGbz8TEiJKViPr1AiWw==&no_redirect=1&google_push=AXcoOmQWzd1CpZGN_01anxm5-vUr1rgZFlR9oFN4pzPtbLPMUL4UZk...

170 B
188 B

155ms
154ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=DW3ZGbz8TEiJKViPr1AiWw==&no_redirect=1&google_push=AXcoOmQWzd1CpZGN_01anxm5-vUr1rgZFlR9oFN4pzPtbLPMUL4UZkY-_JlzsIT5dUE3kUcCw7ZzcXL_C45bypZivAc6ONE5PppmIr8

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //cm.g.doubleclick.net/pixel?google_nid=media_force_communications_2007_ltd&google_hm=DW3ZGbz8TEiJKViPr1AiWw==&no_redirect=1&google_push=AXcoOmQWzd1CpZGN_01anxm5-vUr1rgZFlR9oFN4pzPtbLPMUL4UZkY-_JlzsIT5dUE3kUcCw7ZzcXL_C45bypZivAc6ONE5PppmIr8
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 02:58:14 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 36B5
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_push=AXcoOmT0cT8IAKqH0K5WxQm34xc2HOJR8JN0Lzk0rUUNp9FgEtohBZiU1kYHM_Ad7hVapA6xxYDAX-gMhdZFq6IPS3GUSO-fAJafT3s
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0cT8IAKqH0K5WxQm34xc2HOJR8JN0Lzk0rUUNp9FgEtohBZiU1kYHM_Ad7hVapA6xxYDAX-gMhdZFq6IPS3GUSO-fAJafT3s

170 B
188 B

153ms
153ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0cT8IAKqH0K5WxQm34xc2HOJR8JN0Lzk0rUUNp9FgEtohBZiU1kYHM_Ad7hVapA6xxYDAX-gMhdZFq6IPS3GUSO-fAJafT3s

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

access-control-max-age: 86400
x-bytefaas-request-id: 20250529025814213C37A239EBF6778149
access-control-allow-methods: *
expires: Thu, 29 May 2025 02:58:14 GMT
server-timing: inner; dur=6, cdn-cache; desc=MISS, edge; dur=1, origin; dur=16
x-cache: TCP_MISS from a23-40-16-172.deploy.akamaitechnologies.com (AkamaiGHost/22.1.3-3f9e981ebbcef7152f4c0c8abb8541d4) (-)
date: Thu, 29 May 2025 02:58:14 GMT
x-akamai-request-id: 95455192
x-tt-trace-host: 012180f69a7f42a71d0771def4c5a9037234e41d8514bcfa32c38d3d44c531c08fb6975b96491ddadd00164c409dcc398681e0b981da41689852ac4f8ce43f1666da7a82a0883e64acf1e8b048b48c84315e5d443cf5f55e696cbe97a1368763bd
access-control-allow-headers: *
x-bytefaas-execution-duration: 4.86
x-origin-response-time: 17,23.40.16.172
cache-control: max-age=0, no-cache, no-store
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmT0cT8IAKqH0K5WxQm34xc2HOJR8JN0Lzk0rUUNp9FgEtohBZiU1kYHM_Ad7hVapA6xxYDAX-gMhdZFq6IPS3GUSO-fAJafT3s
pragma: no-cache
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-credentials: true
access-control-allow-origin: *
x-tt-trace-id: 00-250529025814213C37A239EBF6778149-6F9B8DDC8CE3A182-00
content-length: 0
x-tt-logid: 20250529025814213C37A239EBF6778149
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 36B5 0
12 B 152ms
150ms Image
text/html 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JnWTqYjmwx7sVJwCNT-KIGivufcj5Gfdej1NwZHEFxp64vdgbKO2eJmLKk_Z6Vzkt9LpjXmOXh

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 29 May 2025 02:58:13 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 4532 38 KB
13 KB 137ms
136ms Document
text/html 2607:f8b0:4006:820::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2818
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 02:11:15 GMT
expires: Thu, 29 May 2025 03:01:15 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 740B 0
0 315ms
166ms Fetch
image/png 142.251.41.6
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstYccN77to6IYfDlO7GIrN8OigVf1wLWVpFXOeLftpXIfw1YSLdUjZilpOJIT_1tIkMKqNl4R2s9R_uoAXdSBewurMnJQCgyjb0q5LdK2bx3QzoSG0NqGX9CvdXGF7e9AfEfq9zdHT_mi2gvFAt7ynn_dSzV_1JIEHFrRd6LIuGtFF-r-LFquzzPJ68dmQzG2Kye0tdcKX2m6hN8P8fo9jkKQHEPWTxGNN7X7zlx_cxYe-bGEwg-OeslDl2HR879tnobytoFvUkEgFGxEUUfzw11faOuxMMHBF1lAZLuM1jc9-lsjC1WYHa8ZiwJ9S5Zui3UJvQvWO1kREtZe7lZyjEMZOK6o9mGwMSSlm1CU7M6bRqW9G6HYX62ZApLMLHXbKT5l8-gLwkASCDfADW-BP8XB99NbgZjbCtwUMjwnASEmtOsTkI4bH1kDqTyAJdyQoOf84HqesPQyKUPpPPgI1KwFjltRFNaGkDQhCZciJUnyHWthUDYNkXN7N3YwzHyeWE2y8cj5IRL1-ne38tX7h1huQRAaJepSVA6Ud7AYEcOLRseHUdlGtBYKczmjxUAv_vXLoCQgmmxglZ1IXGZljpqTcom6-_oOShxsCmXjSjRF6F6Uy5zQKJ4PxUtLjwjlAWN3wgjL1nfMm6M_cDbasdq0sNk9ZNrjob73D-3VTy-OuH4I7pR1puHR5Jj7GgmAhJ57r3LWrlhb-vmagLyiQ3WuWWTaLzLyO01L8YQSipXHqGUv0Uo7qyGev5EqYIw-5EyfkRend5FmMzyL4Cfi6xLw1ctNo-igeVXNvOGPyAP2PcGbyeXjsNjPwXTWZq6Ffn9xids2oxzKW53AiqP0LXj2RV2Feyqd-9DG8-mC_Sqy-X1JCgMhYlMNFFb-lIUVN4IVerQB09M7p3ZDpf6Q-_JOf4RUujSUkgfFLC295dbi03M4_hsjeH6Xk3sLlWmrLZ47ZXA5pl3ATXhdnjx8ZjA1vHo7xfcTLDiXmuFAJfsbJr40MtPQrKe5HjX-hBjC6si0W33nGmy32eG2uSk5QPvA5Oz-NnfY3G-t9lmZTluAcwZNmpg4mT4OF_aUR5qcocG2hPm6KhJwzaNMLsdCSJ6sWhNpChg1-BSPKNRDwV72hDWHy5pIVkCbmtXUJgCzT3-Thbn1_d9bVN7Iv8BCghnO-1opZyxI4yl3QP-jFVSUhhxreCMuJFcFJeUd4xFPQ8ESisjFaMFX0Aft1_uP1k5dIUUjuWYsRtqdaJxw1nMkSwFTlftuOMYO_Vm6ZZG0opTQCk3wjQyPjyZpdli9iaNbjaUMe6u7mmE5p2HC5GVMpJasVkotlB4JDcTcM_PJIYb-YLKVWw6Sho9YhfbmwIm_YDCROVdjQWUoT9PLFq_6ou6mM56x6f-D0FybeQvWT1m51CnSGOs7JgSyF245QUx1K4Mf76ut7Bi72szJ1sFmUOWVNjuRMM1tbsfmoo8n7P4Yb5rmEd1SIbCYS6H-G-kmmJG7wd-3u6cPH_X1DwS0cdHfukSCN4rY4zMp0M7G4zNA0KoguBNxd6yu8qIrB-PADN4F6CQbhIjjqXEMHVvGEcUMLilTS5u0CLlF6vyXAJok40jD3JwZQT92FhmhDuY4Js-u4lRpbAZ4AHKAc9BxXOVa2_rCLJQy2UC0lzfgtIMiX6QQQUZYdOv1WFGXJ1GzzvD0JKF2znpq0z-1_hNbA3i6b7OlgZX0SyaJZH3K0GopAso4hGMU_2G2KFEuMvQN6tXC1lDuIaFhqNyNzjKECfuD7aZG4f3DbZhJtFBg7Ip5O-2sUPY4ajEikW8MGORWsaDx3QN6d21ug2n7MjfeIRrvs9qTptp_huYOjeTlrnANvKX0fnCJ3-iqpIP0MJYXM6vzSgzbsSn7O28UVZ6RZkLAPCh9q3ArHbdBdJGPk&sai=AMfl-YQDn13zyQp6H0OKganfriLXuFapd_V0SQtLRctcWHN4kUBHQspiKls3jK_BlhCVA3hfzU1TGhxzafrmnHnt51lYnKEdXZWVfndLPJudVy_uiZFP7ZSGMQkCq7f2rT0CzEPxL_kKm_zXEm76F_4z63v_KF2t9-Wz5iUptsKvpiUzy0qxSaok0Gypem6VtCMXVDzo32E_s1gUkGTuVH-l4X1wj7IbGPrpuDj0Y4LkrY_-CqNYwCwizz_UEe4cMeJYTu9l4HpQnWSuzmMpMA3924vsV7Vgx5a5WEM0hlYa8MW_n3retYrsGsbdWED3h75JX21KCn3uqv_RLkp4vSK9dMQKnLRaQPab0car1I-aHN9UmOIlhy4X1FpTmc7c0nV1fEdG2vyuKXPi7r0Z4zICR4sou_ezfHL-sNyC&sig=Cg0ArKJSzK8piHhGHw0DEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=607&cbvp=1&cisv=r20250527.81341&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

x-content-type-options: nosniff
expires: Thu, 29 May 2025 02:58:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/png
content-security-policy: script-src 'none'; object-src 'none'
cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x528c90208c0bfc800000000000000000","908705425":"0x697d407dc86261830000000000000000","908705426":"0x4a14fcbdfffae64f0000000000000000"},"debug_key":"2101085027441978164","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054","3582797","3582795","3572756"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"1328794253779287888"}
server: cafe

GET
H3 200 17450261799610016487
s0.2mdn.net/simgad/ Frame 740B 16 KB
16 KB 284ms
139ms Image
image/jpeg 142.250.176.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17450261799610016487

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

sffe /

Resource Hash

008b78fc5ec6cec3dd77e8b57615221d6feae2c47aa878b108eafee1f3b092cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

age: 17784
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Thu, 28 May 2026 22:01:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 28 May 2025 22:01:50 GMT
last-modified: Tue, 29 Apr 2025 17:31:19 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 16515
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 740B 451 B
605 B 379ms
145ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?ctx=12268837&cmp=32891887&sid=8602117&plc=417855942&crt=234270386&advid=5925338&adsrv=1&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&unit=160x600&prr=1&aucmp=22360936694&auevent=ABAjH0irI5_odwkwNA2G4pPst3xB&autt=1&ppid=103&aucrtv=647734296&auorder=1020504884&pltfrm=1&ausite=1995081996404&auxch=1&aufilter1=2765340&c1=2765340&adid=&app=&dup=&gmnpo=&isdvvid=&supplySource=&tagtype=&aUrlD=0&brid=96&bridua=3&brver=&brh=2&vavbkt=&lvvn=28&fcifrms=23&winh=600&winw=160&chro=1&noc=16&wouh=1200&wouw=1600&htmlmsging=1&refD=1&scah=1200&scaw=1600&jsver=7873&uid=1748487493976164&srcurlD=0&ttfrms=53&num=6&dvp_isOnHead=0&flvr=1&ver=7873&jsCallback=__verify_callback_1748487493976164&jsTagObjCallback=__tagObject_callback_1748487493976164&ssl=1&prndr=1&m1=96&blkmode=2&ee_dp_rdystreq=loading&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=16259730230.670692&ee_dp_sukv=16259730230.670692&dvp_tukv=60013760198.19604&ee_dp_tukv=60013760198.19604&dvp_strhd=0.5&dvpx_strhd=0.5&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauhh4f5f6a5ch242gdae2ece6%605%604337_f%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&referrer=https%3A%2F%2F99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 599fd3f03bc4f1ad91f1f59e98098fa37199c56b8a407a5a7f74a99047a4fc5c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
X-DV-Response: 0
Expires: 05/28/2025 02:58:14
Date: Thu, 29 May 2025 02:58:14 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 740B 0
0 159ms
158ms Fetch
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 740B 0
0 151ms
150ms Fetch
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 740B 0
0 151ms
150ms Fetch
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3

200

setuid
prebid.intergient.com/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dappnexus%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID
https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1564310468653297776

86 B
1 KB

158ms
156ms

Image
image/png

104.18.20.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1564310468653297776
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.20.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c2ecff291918a3caf0b7e470323e89f2a1f05b92e12a10649e598cacebe62acf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487494&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=6ukHmzdUaWCc2iiHUFH%2BDmrefc28OYgQKMZYl97bRLs%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/png
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487494&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=6ukHmzdUaWCc2iiHUFH%2BDmrefc28OYgQKMZYl97bRLs%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9472ba96fc52d9df-LAX
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://prebid.intergient.com/setuid?bidder=appnexus&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=i&uid=1564310468653297776
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 1d03da23-85cd-4600-aa9f-3ffdbbcfc321
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame DE3E
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=

35 B
591 B

136ms
135ms

Document
image/gif

185.167.164.52
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.52 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 29 May 2025 02:58:14 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame F174
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41087F52-A0BD-4E18-B356-E4A8E51A75FB&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41087F52-A0BD-4E18-B356-E4A8E51A75FB&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

153ms
152ms

Document
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41087F52-A0BD-4E18-B356-E4A8E51A75FB&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 29 May 2025 02:58:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 2KJQ94GX858JVPA2VZFA

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 29 May 2025 02:58:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=41087F52-A0BD-4E18-B356-E4A8E51A75FB&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 8PQ4GFNTKP2B5KVB212F

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame CC0E
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1564310468653297776&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1380ms
131ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-35-76.compute-1.amazonaws.com

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:15 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1

200
OK

cookie-sync Show response
match.prod.bidr.io/ Frame 82BC
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDTDVVN1FiNXNBQUJ1ZmNva1k5QQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AACL5U7Qb5sAABufcokY9A&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4771262960647934481&gdpr=0&gdpr_consent=

43 B
433 B

133ms
132ms

Document
image/gif

52.6.35.76
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4771262960647934481&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.6.35.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 43
Date: Thu, 29 May 2025 02:58:15 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: image/gif
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
pragma: no-cache
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

cache-control: no-cache,no-store
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
location: https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4771262960647934481&gdpr=0&gdpr_consent=
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma: no-cache

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame 000B
Redirect Chain

https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_da8d1d3f1842428990cfd
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
324 B

2291ms
2018ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:15 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame D48D
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=978758911471814302
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1375ms
131ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:16 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame DB09
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=MgoQMWusXnRTIiMc0uYG6KL1zvg&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

2285ms
133ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:15 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame AC55
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
153 B

223ms
222ms

Document
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDfNRgAE9um-7QAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2825
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 29 May 2025 02:58:14 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 1937
x-robots-tag: noindex
x-served-by: cache-toj-leto2350021-TOJ
x-timer: S1748487495.529670,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDfNRgAE9um-7QAw
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-toj-leto2350021-TOJ
x-timer: S1748487494.217864,VS0,VE88

GET pubmatic
ad.mrtnsvr.com/sync/ Frame BFEE 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame B89C
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://r.bidswitch.net/sync?bidswitch_ssp_id=pubmatic&bsw_custom_parameter=0186438e-8da5-4640-abda-99519b46ab8e
https://x.bidswitch.net/sync?dsp_id=393&user_id=0&ssp=pubmatic&bsw_param=0186438e-8da5-4640-abda-99519b46ab8e
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0186438e-8da5-4640-abda-99519b46ab8e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
283 B

136ms
136ms

Document
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0186438e-8da5-4640-abda-99519b46ab8e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 29 May 2025 02:58:15 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=0186438e-8da5-4640-abda-99519b46ab8e&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame CAD8
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=14455573-580a-4e04-9e93-6fd227d806a4&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41087F52-A0BD-4E18-B356-E4A8E51A75FB

42 B
517 B

131ms
130ms

Document
image/gif

174.129.20.2
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41087F52-A0BD-4E18-B356-E4A8E51A75FB
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.129.20.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-174-129-20-2.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 29 May 2025 02:58:14 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:14 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame DA7B
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

2290ms
131ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:15 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1 404
Not Found d0d3910d86e99acbd84ac90b691dc0c5.gif Show response
cs.krushmedia.com/ Frame 91EE 9 B
519 B 486ms
150ms Document
text/plain 80.77.82.130
NATCOWEB

General

Check archive.org

Download Go to

Full URL: https://cs.krushmedia.com/d0d3910d86e99acbd84ac90b691dc0c5.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=&ccpa=[CCPA]&coppa=[COPPA]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 80.77.82.130 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software: nginx /
Resource Hash: 0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Type: text/plain
Date: Thu, 29 May 2025 02:58:14 GMT
Expires: 0
Pragma: no-cache
Server: nginx
Transfer-Encoding: chunked

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 909B
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=e5eb8cdd15bb4052&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU2cb0bb4e36484ca6afec4d68f905aaff

42 B
412 B

668ms
667ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU2cb0bb4e36484ca6afec4d68f905aaff
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 29 May 2025 02:58:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-length: 166
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:15 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU2cb0bb4e36484ca6afec4d68f905aaff
pragma: no-cache
server: Tengine

GET
H2

200

v1 Show response
match.sharethrough.com/sync/ Frame B6A8
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=60ayEL4atRLwR7YT6xqsEOxPsRXwHbcR6x02Ohr5
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1380ms
132ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:16 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 416D
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
93 B

136ms
136ms

Document
text/html

207.65.37.184
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.184 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 02:58:14 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame CD7E 43 B
346 B 274ms
120ms Document
image/gif 35.186.193.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Thu, 29 May 2025 02:58:13 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
via: 1.1 google

GET
H2

200

v1
match.sharethrough.com/sync/ Frame 36BC
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=c386f9b2-3c38-11f0-80b5-3121efcc552a
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
0

1368ms
132ms

Document
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326&us_privacy=1NNY

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache
content-length: 68
content-type: image/png
strict-transport-security: max-age=16000000; includeSubDomains; preload;

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 02:58:16 GMT
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame C27C
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=41087F52-A0BD-4E18-B356-E4A8E51A75FB
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_error=15

42 B
60 B

118ms
118ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 248
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

mw
mwzeom.zeotap.com/ Frame C27C
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=xksw9la&ttd_tpi=1&gdpr=0
https://pixel.onaudience.com/?partner=147&mapped=0a831894-4f5b-4a69-a2cf-c9858718c72e&icm&gdpr=0&gdpr_consent=&cver
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0&xl8blockcheck=1
https://pixel.onaudience.com/?partner=161&icm&cver&mapped=852e0cf3bb178be8b4930ddc1eb3b7fc&gdpr=0
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-cVx4TZtE2pSa1.W_bq5DdWikXeS9XdYdaA--~A&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=59b4f0fcef1a729a
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=47f9310f-d7fe-4498-53fa-c2c0e502bea8&reqId=df752536-4479-4906-4ba1-26d7fd69c045&zclui...
https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=47f9310f-d7fe-4498-53fa-c2c0e502bea8&reqId=df752536-4479-4906-4ba1-26d7fd69c045&zcluid=59b4f0fcef1...

95 B
188 B

243ms
237ms

Image
image/png

2606:4700::6812:1472
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=47f9310f-d7fe-4498-53fa-c2c0e502bea8&reqId=df752536-4479-4906-4ba1-26d7fd69c045&zcluid=59b4f0fcef1a729a&zdid=1332&google_error=15

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700::6812:1472 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 9472baa8feeb25da-LAX
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Thu, 29 May 2025 02:58:17 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=&google_cver=&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=47f9310f-d7fe-4498-53fa-c2c0e502bea8&reqId=df752536-4479-4906-4ba1-26d7fd69c045&zcluid=59b4f0fcef1a729a&zdid=1332&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
date: Thu, 29 May 2025 02:58:17 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame C27C
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=41087F52-A0BD-4E18-B356-E4A8E51A75FB&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=41087F52-A0BD-4E18-B356-E4A8E51A75FB&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=41087F52-A0BD-4E18-B356-E4A8E51A75FB
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=0a831894-4f5b-4a69-a2cf-c9858718c72e
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=0a831894-4f5b-4a69-a2cf-c9858718c72e
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=1564310468653297776&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=3135167154967913612&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
170 B

224ms
224ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDfNSQAJILqstgBa
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748487498.640084,VS0,VE0
age: 3373
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 29 May 2025 02:58:17 GMT
content-type: image/png
x-served-by: cache-toj-leto2350021-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 14

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDfNSQAJILqstgBa
x-timer: S1748487497.325038,VS0,VE91
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 29 May 2025 02:58:17 GMT
x-served-by: cache-toj-leto2350021-TOJ
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDEwODdGNTItQTBCRC00RTE4LUIzNTYtRTRBOEU1MUE3NUZC&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

2292ms
2020ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:15 GMT
server: nginx

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame C27C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=QQh_UqC9ThizVuSo5Rp1-w%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15

20 KB
20 KB

124ms
123ms

Image
text/html

23.44.17.14
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.44.17.14 Elk Grove Village, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-44-17-14.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=121032
content-encoding: gzip
expires: Fri, 30 May 2025 12:35:26 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 29 May 2025 02:58:14 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_error=15
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 321
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&google_error=15
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1191ms
133ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:17 GMT
server: nginx

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:5CE3CB3C703E406183AB83F8B6AFB37F
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1202ms
132ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:16 GMT
server: nginx

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1247ms
133ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:15 GMT
server: nginx

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame C27C
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-HBEouzRE2uVCrMIGi_Ek0pjWcZ.d6eQ-~A&gdpr=0

0
260 B

430ms
136ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-HBEouzRE2uVCrMIGi_Ek0pjWcZ.d6eQ-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:14 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-HBEouzRE2uVCrMIGi_Ek0pjWcZ.d6eQ-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 29 May 2025 02:58:14 GMT
content-type: text/html
server: ATS

GET
H2 200 41087F52-A0BD-4E18-B356-E4A8E51A75FB
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame C27C 43 B
519 B 143ms
133ms Image
image/gif 2600:1f18:4e9:5a01:1cb2:c061:ea6e:bea1
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/41087F52-A0BD-4E18-B356-E4A8E51A75FB?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:1cb2:c061:ea6e:bea1 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=2420f52e-6bb0-4aed-ad03-b8b3f5bff81b&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

1241ms
134ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:16 GMT
server: nginx

GET

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=74fd2818164107c0&is_secure=true&networkId=17100&version=1&nuid=41087F52-A0BD-4E18-B356-E4A8E51A75FB&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQADfAbJXTNrhQIjWaSwAQEBAQEBAQCWGPjaiwEBAQEBAQEB&expiration=1748573894&nuid=41087F52-A0BD-4E...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

0
0

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame C27C 0
162 B 171ms
134ms Image
text/plain 35.174.227.121
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.227.121 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-174-227-121.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 02:58:14 GMT

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=66b82463-e1cc-4b9e-bd77-9eb179e7860d-6837cd45-5553&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

2289ms
132ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:15 GMT
server: nginx

GET
H2

200

v1
match.sharethrough.com/sync/ Frame C27C
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=3135167154967913612&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156557&pr=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DuFFr5RFBYgoUJbWMAWGEZKS3%26source_user_id%3D41087F52-A0BD-4E18-B356-E4A8E...
https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

68 B
323 B

2286ms
135ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

cache-control: no-store, no-cache, private
location: https://match.sharethrough.com/sync/v1?source_id=uFFr5RFBYgoUJbWMAWGEZKS3&source_user_id=41087F52-A0BD-4E18-B356-E4A8E51A75FB
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:15 GMT
server: nginx

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame C27C
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R35393_1290E4A19_AF8038D5F&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

137ms
137ms

Image
image/gif

38.98.69.175
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.98.69.175 North Bergen, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-431492294; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-431492294; includeSubDomains
Cache-Control: no-cache
Date: Thu, 29 May 2025 02:58:13 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 02:58:14 GMT
server: nginx

GET
H3 200 oXoIHB2Kmvg8sIs6czd4451tHWj0l836YFT8C3MOWhg.js Show response
pagead2.googlesyndication.com/bg/ Frame 4532 54 KB
21 KB 137ms
136ms Script
text/javascript 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/oXoIHB2Kmvg8sIs6czd4451tHWj0l836YFT8C3MOWhg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

sffe /

Resource Hash

a17a081c1d8a9af83cb08b3a733778e39d6d1d68f497cdfa6054fc0b730e5a18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 17296
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Thu, 28 May 2026 22:09:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 28 May 2025 22:09:58 GMT
last-modified: Mon, 26 May 2025 12:38:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21086
x-xss-protection: 0
server: sffe

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame 200B 0
798 B 139ms
138ms Script
text/html 68.67.178.10
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.178.10 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 162.245.206.248; 162.245.206.248; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: fcf39ab3-6fb0-4fc5-aa73-e72b0d35a70b
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3 200 usermatch Show response
ssum-sec.casalemedia.com/ Frame 00AD 2 KB
1 KB 183ms
89ms Document
text/html 104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b8e8d7b90f3312754cf7222787fa38ed309a0ab45b361f1a24449c1629bbd76

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9472ba989db5d7a4-LAX
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 02:58:14 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cTLFzUXdxZJQHaCORiIIWGZndkYbKEuw5ZTlgkvh9GZSCXDsIfmhliSISKSSaAKwnyzqQ774ERwjHRSkui0TKozt92%2F5WddfPqPWKmki05zsWFt8K3VHT1%2B68aXr6K8DGWxMQb9YAwNwQQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame 740B 578 B
701 B 346ms
143ms Script
text/javascript 34.117.228.201
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=1&ttmms=21&ttfrms=53&brid=96&bridua=3&bds=1&tstype=128&prndr=1&eparams=DC4FC%3Dl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTauU2%3F4r92%3A%3Fl9EEADTbpTauTauA2%3A%3FE%5DE%40JDTar9EEADTbpTauTauhh4f5f6a5ch242gdae2ece6%605%604337_f%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=73&ddur=607&uid=1748487493976164&jsCallback=dvCallback_1748487493976143&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=600&winw=160&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=7873&tgjsver=7873&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2F99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-45%2Fhtml%2Fcontainer.html&fcifrms=23&brh=2&dvp_epl=205&noc=16&nav_pltfrm=Linux%20x86_64&ctx=12268837&cmp=32891887&sid=8602117&plc=417855942&crt=234270386&adsrv=1&advid=5925338&unit=160x600&c1=2765340&bsimpid=6ae88d628afd4b789ddcb295d00deb7c&prr=1&errorURL=https://tps.doubleverify.com/visit.jpg&ppid=103&auevent=ABAjH0irI5_odwkwNA2G4pPst3xB&aucmp=22360936694&aucrtv=647734296&auorder=1020504884&ausite=1995081996404&auxch=1&pltfrm=1&aufilter1=2765340&autt=1&mib=0&mon=1&blk=1&dvp_cawf=crtwrp&cm360cw=1&dvp_rcp=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=16259730230.670692&ee_dp_sukv=16259730230.670692&dvp_tukv=60013760198.19604&ee_dp_tukv=60013760198.19604&dvp_strhd=0.5&dvpx_strhd=0.5&dvp_tuid=761447504807&jurtd=898416998
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbm.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 201.228.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 687bde9afe90fcdbb4656080bd146c8569a5385ae55ef308b86648af123deb1a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

Transfer-Encoding: chunked
Cache-Control: max-age=0
Timing-Allow-Origin: *
Content-Encoding: br
Pragma: no-cache
Connection: keep-alive
Expires: 05/28/2025 02:58:14
Date: Thu, 29 May 2025 02:58:14 GMT
Content-Type: text/javascript
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame BFEE 3 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame BFEE 5 KB
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4222715b556e7d99622c83e620d2f8e090047e56adb07923047f95828d561f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4532 0
20 B 152ms
152ms Image
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B42CVRM03aKiWMMW-6toPz8GiuQoAAAAAOAHgBAI&bg=!KimlKWbNAAZOHwLPbh87ADQBe5WfOObEilVnAudwJMZQOAOpqokakYMrQLn-mV20dEnK_wb-PgHlxPuQyimW5jRCXBjcAgAAAJxSAAAAB2gBB34ANU1SKixEfjE9jwEKZGb66fx6c5YH1TONufthb0YNEhoeSeftysdnvJ_0Z7erR5DZpOYRkLwZmQKpdmveHbJqHN2QuZtMcHxPddEQPCJK9Y1LBQ7uRoD8H3gCHe7MYspmPKJSBppadZRT6LINSAHj9d4Ca_g5odjIaE4vbC8iYITAWzSfSO0_oQM08WWU4Pw3ETTue9hJRS-ZXN39n4nDHgDu8IapAvcE2PeVlNGvldZ5mabsrE0pQIzW-n0kEiYcUkV4EtClvN8o1Tbz88-4r5S30J6lZbLoj_uGZbiHtErh-VQo48cxTe-4wLJ0d79EsuYKppF5Z6hZr90Rv8sWHL65vlNXflbBVqTbU8jOvG6XbT7Iazsg16ArAwL-gm69x5A-4C9gpbrUsnCJxzzR-HykYbguXEKjB0CPpEVFq6W3HsHUzGnz78Ot861a27yZAnJQV83ybllq_0FGelVULfa0pnZBNY5qiE1f03LZyRO7O8u-gRhArAGljeGDYUjiejlNAqnDglh6DVNoEdCZv2Qe4r81iM3SlMMC_6B-a4hjQZWVYw_fzWRgkBFaCsSocENtv4yeTwQzFeviM6bjDJitABxFvk0wvGKkbTLyQhII4tooN2lAMiqoIw0OTAcFhnc5tKkjdSlC1daBm-JTc2PFAAVPZLwnx8FAyiSK-ThXooXeNpLKP0s0FWgIG-Sz2jXCks90iXCD2KVRxCDUVuRgnPS-rNel9FRQWdsvN0pN52iUATqjpNBWMkE9nJ9O2zwnmhJF4bsfTUb5FwLAkFLA_57NAP9sTlOt0bS4dszSg00AtesvsIWUtCWTGwIygz_RMIp5K5QUaoSUHCzeePOw1g2jhFd_Oe2P1xT91VybZsU1PJ4xt9Fu-zKyX8QMIOJg9_J-Ut-ZUKcMuYsWvgeUCuUcMrYp1MtPG3AU-JL30CEf0a641QVRhfvg1FglVxaFaPanW793nVSZzk-VcXTY

Requested by

Host: 99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com
URL: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 00AD
Redirect Chain

https://match.adsrvr.org/track/cmf/casale?us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&expiration=1751079494&gdpr=0&gdpr_consent=

43 B
766 B

88ms
87ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&expiration=1751079494&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2gj2WVc5FKgHuLaex4vfdghN2I%2FKcuR%2BgdhQopJ3qddMU1B7oeFJ5h25MBpkbiLP%2F3ea9T%2B0ZZaMujl0bLr8sjQrFfqhaxpduoMgVpqBNI1%2F8CIegc%2BT4iokxc%2FuKA65XiVte5whcwxIdw%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba99dbf5091d-LAX
content-length: 43
server: cloudflare

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=0a831894-4f5b-4a69-a2cf-c9858718c72e&expiration=1751079494&gdpr=0&gdpr_consent=
content-length: 323
date: Thu, 29 May 2025 02:58:14 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 00AD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDfNRtHM4Z4AC5zIAUIvkgAA

170 B
188 B

152ms
152ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDfNRtHM4Z4AC5zIAUIvkgAA

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=llX%2BjZ%2BABRjvEQ86YGaD6YMX5dQgCDEGvOjj7CfemcrUr3yCm6tCyBxhZZrfnB%2BeSPLvMi%2FmBELGqwaqeWLZcXNvkFtoVjZj63V3%2B5Aqub6Xxjz4af9Y%2Bbb7WxGZLS%2Bt8i7wbVM3frq9%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
location: https://cm.g.doubleclick.net/pixel?us_privacy=1NNY&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=aDfNRtHM4Z4AC5zIAUIvkgAA
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba993b3a091d-LAX
content-length: 0
server: cloudflare

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame 00AD 43 B
855 B 238ms
140ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=1NNY&gdpr=&gdpr_consent=&id=aDfNRtHM4Z4AC5zIAUIvkgAACawAAAIB&gpp=&gpp_sid=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 8KD43VNMTPEMVH5BWB68
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 02:58:14 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H2

200

sync
pippio.com/api/ Frame 00AD
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aDfNRtHM4Z4AC5zIAUIvkgAA%262476&gpdr=&gdpr_consent=&us_privacy=1NNY&gpp=&gpp_sid=
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=22042997-2afd-4674-b47a-e7ef780b67cb&us_privacy=1NNY
https://p.rfihub.com/cm?pub=39342&in=1&userid=5da8216d-d6f5-4548-a2df-15d885b90343%3A1748487495.0788279&forward=https%3A//i.liadm.com/s/56409%3Fbidder_id%3D200442%26bidder_uuid%3D5da8216d-d6f5-4548...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=978758911471814302&referrer={encSite}&forward=https%3A%2F%2Fi.liadm.com%2Fs%2F56409%3Fbidder_id%3D200442%26bidder_uuid%3D5da8216...
https://i.liadm.com/s/56409?bidder_id=200442&bidder_uuid=5da8216d-d6f5-4548-a2df-15d885b90343%3A1748487495.0788279&pid=500040&it=1&iv=5da8216d-d6f5-4548-a2df-15d885b90343%3A1748487495.0788279&_=174...
https://pippio.com/api/sync?it=1&pid=500040&_=1748487495.0800128&iv=5da8216d-d6f5-4548-a2df-15d885b90343:1748487495.0788279

42 B
344 B

271ms
124ms

Image
image/gif

107.178.254.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://pippio.com/api/sync?it=1&pid=500040&_=1748487495.0800128&iv=5da8216d-d6f5-4548-a2df-15d885b90343:1748487495.0788279
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Server: 107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 65.254.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 02:58:16 GMT
content-type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://pippio.com/api/sync?it=1&pid=500040&_=1748487495.0800128&iv=5da8216d-d6f5-4548-a2df-15d885b90343:1748487495.0788279
Content-Length: 0
Date: Thu, 29 May 2025 02:58:16 GMT
trace-id: 6a81b1e7e257d112
Request-Time: 1
Connection: keep-alive

GET
H3

200

crum
dsum.casalemedia.com/ Frame 00AD
Redirect Chain

https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID&us_privacy=1NNY
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1564310468653297776&us_privacy=1NNY

43 B
755 B

87ms
83ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1564310468653297776&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=woIH3qQ94rHhoxaQNqPtuGwqB%2FpfXcKkm6hWOdZV6QKaNpH3Fed82hf%2FLir44nsoUuU5tnP4QxbkJI1LSIcKaO2rQL%2FRFHC9Zr%2B2ilQHvV0UBshdByXL3MjJ14ZdvgdLsp2RFoEF"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba9a1a98d7a4-LAX
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1564310468653297776&us_privacy=1NNY
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 162.245.206.248; 162.245.206.248; 634.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 6f74119b-f0c3-4f5b-8e3d-6ac3908f4334
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 00AD
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=2079&us_privacy=1NNY
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758911471814302

43 B
762 B

91ms
91ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758911471814302
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jwPnOZJrNfWidC3riyF2sbq9OFkcWNAdCcMDKGaVjs9X%2BH2vNCuoYN2uzfwWuuIGo81uiSWbdYE6Kx%2FynyBhjKgJOUdCHzVbUGQb3oXreTgO46MdW9yBVniYu6gaRdM6Ct581hMyKQ5YnQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:14 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba9a1c4f091d-LAX
content-length: 43
server: cloudflare

Redirect headers

Location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=978758911471814302
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Date: Thu, 29 May 2025 02:58:14 GMT
Server: Jetty(9.4.51.v20230217)

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 00AD
Redirect Chain

https://dsp.360yield.com/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aDfNRtHM4Z4AC5zIAUIv...
https://dsp.360yield.com/ul_cb/dsp_match/275?ssp=10&gdpr=&gdpr_consent=&r=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D15%26external_user_id%3D%7BDSP_USER_ID%7D&userId=aDfNRtHM4Z4AC5...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=8f890145-aeb3-4724-ae1e-7711dad6910b&gdpr=&gdpr_consent=&userId=aDfNRtHM4Z4AC5zIAUIvkgAA%262476&us_privacy=1NNY

43 B
767 B

97ms
97ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=8f890145-aeb3-4724-ae1e-7711dad6910b&gdpr=&gdpr_consent=&userId=aDfNRtHM4Z4AC5zIAUIvkgAA%262476&us_privacy=1NNY
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CHkrFiiLy2bxjLSpfnekG40uFWhzQ4j78y9T9l65z9Y%2BViPPc5P%2BWMk2at6dg%2FDg422Dia0TN36RMDFGrzKVYJR3bSa4C0%2BrgKSZ1oXpltvG22uThPxiw%2BpS%2FmM9eWZre0DwUFvJEf40fQ%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:15 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba9cbeca091d-LAX
content-length: 43
server: cloudflare

Redirect headers

access-control-allow-origin: *
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=15&external_user_id=8f890145-aeb3-4724-ae1e-7711dad6910b&gdpr=&gdpr_consent=&userId=aDfNRtHM4Z4AC5zIAUIvkgAA%262476&us_privacy=1NNY
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 29 May 2025 02:58:15 GMT
content-type: text/plain

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 00AD
Redirect Chain

https://s.c.appier.net/index?userId=aDfNRtHM4Z4AC5zIAUIvkgAA%262476&gdpr=&us_privacy=1NNY
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=4zz6RMM6Aeql0v45R803aA&gdpr=0

43 B
767 B

92ms
91ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=4zz6RMM6Aeql0v45R803aA&gdpr=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xIpJrvf1Ym%2BCll8HIz7ZCV58B%2BTPY%2FhFNBBfGN%2FEaoVY8JWDDyYCbUBnbnM5poEI1kxqnFokqiubCdkJQZcjEca7r%2FJ3gtK29Vot4kmw9ZS3rRJNlOXwetSq0Rowlef91zzFtZZInnPZ3w%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 02:58:15 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9472ba9cbec9091d-LAX
content-length: 43
server: cloudflare

Redirect headers

Cache-Control: no-store
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=203&external_user_id=4zz6RMM6Aeql0v45R803aA&gdpr=0
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 29 May 2025 02:58:15 GMT
Server: nginx

GET
H3 200 setuid
prebid.intergient.com/ Frame 00AD 0
1 KB 153ms
153ms Image
text/html 104.18.21.56
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?gpp=&us_privacy=1NNY&bidder=ix&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=aDfNRtHM4Z4AC5zIAUIvkgAA%262476
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=1NNY&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.21.56 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748487494&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=6ukHmzdUaWCc2iiHUFH%2BDmrefc28OYgQKMZYl97bRLs%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 02:58:14 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748487494&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=6ukHmzdUaWCc2iiHUFH%2BDmrefc28OYgQKMZYl97bRLs%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9472ba993b3cc213-LAX
server: cloudflare

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame EDFA 7 B
1 KB 392ms
130ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?us_privacy=1NNY
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 581be330dd02e97c44a66ee93ff56178
content-length: 7
content-type: application/json; charset=UTF-8

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 740B 0
0 159ms
159ms Fetch
image/png 142.251.41.6
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjstYccN77to6IYfDlO7GIrN8OigVf1wLWVpFXOeLftpXIfw1YSLdUjZilpOJIT_1tIkMKqNl4R2s9R_uoAXdSBewurMnJQCgyjb0q5LdK2bx3QzoSG0NqGX9CvdXGF7e9AfEfq9zdHT_mi2gvFAt7ynn_dSzV_1JIEHFrRd6LIuGtFF-r-LFquzzPJ68dmQzG2Kye0tdcKX2m6hN8P8fo9jkKQHEPWTxGNN7X7zlx_cxYe-bGEwg-OeslDl2HR879tnobytoFvUkEgFGxEUUfzw11faOuxMMHBF1lAZLuM1jc9-lsjC1WYHa8ZiwJ9S5Zui3UJvQvWO1kREtZe7lZyjEMZOK6o9mGwMSSlm1CU7M6bRqW9G6HYX62ZApLMLHXbKT5l8-gLwkASCDfADW-BP8XB99NbgZjbCtwUMjwnASEmtOsTkI4bH1kDqTyAJdyQoOf84HqesPQyKUPpPPgI1KwFjltRFNaGkDQhCZciJUnyHWthUDYNkXN7N3YwzHyeWE2y8cj5IRL1-ne38tX7h1huQRAaJepSVA6Ud7AYEcOLRseHUdlGtBYKczmjxUAv_vXLoCQgmmxglZ1IXGZljpqTcom6-_oOShxsCmXjSjRF6F6Uy5zQKJ4PxUtLjwjlAWN3wgjL1nfMm6M_cDbasdq0sNk9ZNrjob73D-3VTy-OuH4I7pR1puHR5Jj7GgmAhJ57r3LWrlhb-vmagLyiQ3WuWWTaLzLyO01L8YQSipXHqGUv0Uo7qyGev5EqYIw-5EyfkRend5FmMzyL4Cfi6xLw1ctNo-igeVXNvOGPyAP2PcGbyeXjsNjPwXTWZq6Ffn9xids2oxzKW53AiqP0LXj2RV2Feyqd-9DG8-mC_Sqy-X1JCgMhYlMNFFb-lIUVN4IVerQB09M7p3ZDpf6Q-_JOf4RUujSUkgfFLC295dbi03M4_hsjeH6Xk3sLlWmrLZ47ZXA5pl3ATXhdnjx8ZjA1vHo7xfcTLDiXmuFAJfsbJr40MtPQrKe5HjX-hBjC6si0W33nGmy32eG2uSk5QPvA5Oz-NnfY3G-t9lmZTluAcwZNmpg4mT4OF_aUR5qcocG2hPm6KhJwzaNMLsdCSJ6sWhNpChg1-BSPKNRDwV72hDWHy5pIVkCbmtXUJgCzT3-Thbn1_d9bVN7Iv8BCghnO-1opZyxI4yl3QP-jFVSUhhxreCMuJFcFJeUd4xFPQ8ESisjFaMFX0Aft1_uP1k5dIUUjuWYsRtqdaJxw1nMkSwFTlftuOMYO_Vm6ZZG0opTQCk3wjQyPjyZpdli9iaNbjaUMe6u7mmE5p2HC5GVMpJasVkotlB4JDcTcM_PJIYb-YLKVWw6Sho9YhfbmwIm_YDCROVdjQWUoT9PLFq_6ou6mM56x6f-D0FybeQvWT1m51CnSGOs7JgSyF245QUx1K4Mf76ut7Bi72szJ1sFmUOWVNjuRMM1tbsfmoo8n7P4Yb5rmEd1SIbCYS6H-G-kmmJG7wd-3u6cPH_X1DwS0cdHfukSCN4rY4zMp0M7G4zNA0KoguBNxd6yu8qIrB-PADN4F6CQbhIjjqXEMHVvGEcUMLilTS5u0CLlF6vyXAJok40jD3JwZQT92FhmhDuY4Js-u4lRpbAZ4AHKAc9BxXOVa2_rCLJQy2UC0lzfgtIMiX6QQQUZYdOv1WFGXJ1GzzvD0JKF2znpq0z-1_hNbA3i6b7OlgZX0SyaJZH3K0GopAso4hGMU_2G2KFEuMvQN6tXC1lDuIaFhqNyNzjKECfuD7aZG4f3DbZhJtFBg7Ip5O-2sUPY4ajEikW8MGORWsaDx3QN6d21ug2n7MjfeIRrvs9qTptp_huYOjeTlrnANvKX0fnCJ3-iqpIP0MJYXM6vzSgzbsSn7O28UVZ6RZkLAPCh9q3ArHbdBdJGPk&sai=AMfl-YQDn13zyQp6H0OKganfriLXuFapd_V0SQtLRctcWHN4kUBHQspiKls3jK_BlhCVA3hfzU1TGhxzafrmnHnt51lYnKEdXZWVfndLPJudVy_uiZFP7ZSGMQkCq7f2rT0CzEPxL_kKm_zXEm76F_4z63v_KF2t9-Wz5iUptsKvpiUzy0qxSaok0Gypem6VtCMXVDzo32E_s1gUkGTuVH-l4X1wj7IbGPrpuDj0Y4LkrY_-CqNYwCwizz_UEe4cMeJYTu9l4HpQnWSuzmMpMA3924vsV7Vgx5a5WEM0hlYa8MW_n3retYrsGsbdWED3h75JX21KCn3uqv_RLkp4vSK9dMQKnLRaQPab0car1I-aHN9UmOIlhy4X1FpTmc7c0nV1fEdG2vyuKXPi7r0Z4zICR4sou_ezfHL-sNyC&sig=Cg0ArKJSzK8piHhGHw0DEAE&uach_m=%5BUACH%5D&crd=aHR0cHM6Ly9wYW5kb3JhLm5ldA&pr=missingexchangepricemacro&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1438&vt=11&dtpt=831&dett=3&cstd=1437&cisv=r20250527.81341&vwbs=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=1&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.41.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s40-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Thu, 29 May 2025 02:58:14 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT
x-xss-protection: 0
content-type: image/png
attribution-reporting-register-source: {"aggregation_keys":{"908705424":"0x528c90208c0bfc800000000000000000","908705425":"0x697d407dc86261830000000000000000","908705426":"0x4a14fcbdfffae64f0000000000000000"},"debug_key":"13549586382246924078","debug_reporting":true,"destination":["https://pandora.net","https://pandorajoias.com.br"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"1296000","filter_data":{"14":["3583265","3584054","3582797","3582795","3572756"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["5736037"]},"max_event_level_reports":2,"priority":"0","source_event_id":"14835875681692344"}
server: cafe

GET
H3 200 PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html Show response
s0.2mdn.net/sadbundle/16109550510171750400/ Frame 44E3 6 KB
2 KB 136ms
135ms Document
text/html 142.250.176.198
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16109550510171750400/PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html?ev=01_253

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_281.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

sffe /

Resource Hash

2245cf0ddc4e0b7988f5771eda1e34b2912d8c60c54d9a4e9eae603defcf141e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://99c7d7e2d49aca8526a646e1d1cbbf07.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 17639
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1893
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 28 May 2025 22:04:15 GMT
expires: Thu, 28 May 2026 22:04:15 GMT
last-modified: Tue, 29 Apr 2025 17:31:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 68110cc2c8c9e5ee932db79a Show response
c.bannerflow.net/a/ Frame 44E3 56 KB
20 KB 246ms
86ms Script
application/javascript 2606:4700::6811:6147
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://c.bannerflow.net/a/68110cc2c8c9e5ee932db79a?did=5ced17d285b1c200019c3fe1&&redirecturl=https%3A%2F%2Fad.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssfgbZs_txVXYpiYTlHHko8s0_JKzi_9l38B0-V7Z5R3HSwSyuOsC-yOG0aYkfI1-GGE97yep32XLbi0xvDK2530UzaRmbQUFbPu4EgMv1P5MoQTqdh_rHtDmkzubZQED1ghrAdfmA47vjcywIU8pJMQ0gTfYALAVy8g5F4WvExwIy5B8vzWZ6F8ued80nXv5vFSoWA5C5oaUJE4v9XFe-0_Kz0oDrE_q5ecia3R1lLroHQe7VKQiqGliSH1LIa5Z4D-aO0XT9OuwztXTPK6G8KHwwkFWI4nHhGLRak4yG65spADgqOMSRiYww_skuUWrlDA2MHbekgu9PdHX-1s4M1Asnr9xGtGbez8ny1oKqwDAxU-7GsLPTtb5mrzRAKjF2LRLSd7LPBZ4s4aSDBJkt-vny5Bu1JV4AEsVDmRFUIGN1KcCWAH5Cc9L4aTjK3qiOT5vjdrWaVhY2CWMqGtmiuisX5Pd0GX4lEBANRiUah6u6DuyZrDR1ur5raJ7SGbXELqG3i9Lj7maTRsGeB-BAv51Rz_baxufsT02EcjStCYuKpBs923GL6y0aiDrid-BukBKEi1dBdi4YJwQvL7mebL25Gi676rdDVlZURKbvG_1lM7wgIcVmMXOi6oqfp9GZwCEXs8IG0ZmP98oAkWJr0za9ep1sAYaYqC8J0n9LLJJsOeXWb1BIlQJ84_9awwwjjim13Ir2bn08kQPGOrJ0NhVMbhrCExyX56ixskRs-qgXECQalcVnt1QVasSrZVB6b_WX60slfEBdDzYaDKBZrM6xfk9QhcjQCcc80O4L7D7yq6GO5XMrZkb7ssKhWronAd7yAZwz6_GsiX6GDqg2sLbHKN3l4XQ8uB7paAuZUu9njHRLf1NB1iNGyzA4MvpXGqqYo8t9fL0WflCZL8DA5xD6wGG7ji8HagUFOSpFuojO3Qz4jeRWi7s6dkGss7U33Ht_LVbaasCWnVNdUPLBBhMUmc5OkNsbu8rUc_GoepHYZ31Cwm8pco8GQLfVRl9xgfDhocZInvbd9SbQ8fp150B9CjnpUNtQ-4oqe80zzmYcv0ynbMBC0oAW1qeWK3Zro1ZCFor_sH9COYOFAymarHq91iYDUI-NGXGFjthmz48YsXxJniFpbuZsjFe-QMpGzKZH9DelZK1voNfH5NmzYa8muVi1YVFcxJAU93BgO1jTjRzZKdXGFvZBgu3A0b7IkZqI10TzcO4gb26YlHuHBNwdfCT2Hv8qEU69NSjQ4UcfMdadwGylMSJwv9fubw_1scBRm5orqa0EGsThsA_yWVVlZEYCuCaaC9efHd6Tr6hHVOlYnXMAPhjw2h4sY-0_WnfVa84-Hq-hdgsNFm-KtYyemeLM9SFQEuzFaqJQZVdmcgiDpqPQ0VYpeo_cbHyjvOdNAPnz6l9tKV1S4VmK8dCY3GHeI4fLOc1jJDvw6jG2iEc763apYNetyrWy3pg_MoJLqrW-OtJKHgIdJ7CHc3DS8K2Ovj6lniJleLuLfsSRRjp3Wu3duSvza_AvJUKJgzGfJwNw3hRXaJHZzjTwAnsjtdn1SvrwYrsVy3lpS_7jLGwQQCnqOniW0DtD9iyqax2W8oyzKqeus5HfTfstbVsCgr_CDTBJuhpPG1Ljv7YVfF_TqnVtU6Wlp_cqai0nXqns2fZ0NTg3KTGYvpknnadEJiMYFql6O6Hls-Ihxe-_OnHTrh5TtDLtU3YAKayWvvfDOmAsn7kTR-2OnPkAq0DpPNlF8xjJbp4EYNe78bIk9wN6aaAJ0HsKtfOQUYI-CPpVWLbB1gLvO-2TrnMXy66NpYAjYsRRnQkJqS657cXULg-jLnOL1hQwsTp-7vJFFEJfFsku3NZn_BjXGVsbDA9nYBg053I6yee1TPsDQd7bcWr6-QVg8_LIgrQDn7eT6nvFVGRn9gj5QZokfnLJE6vCzvnw-CDJ1rEDGJg%26sai%3DAMfl-YS-Cgt4MMOmw3vEW2_vg6IlhKlE2WmFhJE_P7JCDrzFhV5vQjhG5b3ShWoc-BvtBVQwEo29qSiR1NB4LY-NW_dbkP_3wRf4Fbm5PVArxLThnOk81EKkykR2KGLEwNSd-fKbuDOFVr3V0OkEzTglkp9YOXZBFmzc4pc0PeTwX5LTrPdTI6_kPx-TdYoImo7wujCMsfs7xCb_oIa4aad6jbavwLynGnzXCOL6D8mhUEEPypFYdWXifIyEcP7mvCOHOprjHsFnrt-6G-LZI8Qy8Gzl%26sig%3DCg0ArKJSzBHYRXt9v8XGEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26crd%3DaHR0cHM6Ly9wYW5kb3JhLm5ldA%26urlfix%3D1%26rm_eid%3D%255Brm_exit_id%255D%26adurl%3Dhttps%253A%252F%252Fus.pandora.net%252Fen%252Fcollections%252Fpandora-essence%252F%253Fcid%253Ddisp%253Adv360%253A%253Aessence%253Amidfunnel%253Ano_promo%253A%253A%253A%253A%253A%253A%253Amixed%253A%253A%253A%253Abelove_summer%2526dclid%253D%2525edclid!%2526gad_source%253D7
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16109550510171750400/PAND1_EN_DISPLAY160X600_COLLECTION_ESSENCE_X_MIXED_CONSIDERATION-V3-638815446710609198-c3bf4ea7-89b5-46d3-8e3a-97b929c1f64f.html?ev=01_253
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6147 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d1244bef37383f1d6e0998e4f681329fa7936ce308a60b309080d0e379e24948

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

cache-control: public, s-maxage=10, max-age=10
content-encoding: br
cf-cache-status: HIT
age: 8
cf-ray: 9472ba9cbaca0904-LAX
date: Thu, 29 May 2025 02:58:15 GMT
content-type: application/javascript
last-modified: Thu, 29 May 2025 02:58:07 GMT
vary: Accept-Encoding
server: cloudflare

GET
H/1.1

200
OK

60909
i6.liadm.com/s/ Frame EDFA
Redirect Chain

https://token.rubiconproject.com/token?pid=49096&us_privacy=1NNY
https://i.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB8SB3PB-1T-50D4&us_privacy=1NNY
https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB8SB3PB-1T-50D4&us_privacy=1NNY&us_privacy=1NNY

43 B
576 B

1308ms
133ms

Image
image/gif

2600:1f18:ed:550e:47ff:a414:1b2c:ab7d
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB8SB3PB-1T-50D4&us_privacy=1NNY&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

2600:1f18:ed:550e:47ff:a414:1b2c:ab7d Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Cache-Control: no-store
trace-id: d54d56a2edd03668
Request-Time: 0
Connection: keep-alive
Content-Length: 43
Date: Thu, 29 May 2025 02:58:16 GMT
Content-Type: image/gif

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://i6.liadm.com/s/60909?bidder_id=227664&bidder_uuid=MB8SB3PB-1T-50D4&us_privacy=1NNY&us_privacy=1NNY
Content-Length: 0
Date: Thu, 29 May 2025 02:58:15 GMT
trace-id: 2f114a0143ec2767
Request-Time: 0
Connection: keep-alive

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame EDFA
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&us_privacy=1NNY
https://pr-bh.ybp.yahoo.com/sync/rubicon/kwOBasKHE45Y4TGAM1IO48n5EUdSAgOZEtemQ7w0kco?csrc=&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-lCzgDgdE2oLOK8mYcdcHjwY2.8z4eiyzq1.sNw--~A

42 B
1 KB

1040ms
1038ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-lCzgDgdE2oLOK8mYcdcHjwY2.8z4eiyzq1.sNw--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-lCzgDgdE2oLOK8mYcdcHjwY2.8z4eiyzq1.sNw--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 02:58:15 GMT
server: ATS
x-frame-options: DENY

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDFA
Redirect Chain

https://token.rubiconproject.com/token?pid=25470&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI4U0IzUEItMVQtNTBENA==&us_privacy=1NNY

170 B
188 B

174ms
173ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI4U0IzUEItMVQtNTBENA==&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:15 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI4U0IzUEItMVQtNTBENA==&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4581d8330ee81d8f36e15dba6d5b7f41
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame EDFA
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon?us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

965ms
710ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 9a0c641c0479142b55591fdf2031b15f
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=0a831894-4f5b-4a69-a2cf-c9858718c72e&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 29 May 2025 02:58:15 GMT
server: Kestrel

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame EDFA 170 B
188 B 163ms
155ms Image
image/png 142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:15 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame EDFA 43 B
855 B 148ms
139ms Image
image/gif 98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: G4J721WJYBK9AX55ZYBN
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 02:58:15 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame EDFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&us_privacy=1NNY
https://s.amazon-adsystem.com/ecm3?id=MB8SB3PB-1T-50D4&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

43 B
479 B

523ms
523ms

Image
image/gif

98.82.156.207
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MB8SB3PB-1T-50D4&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.156.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: JSM774EY8ZTAZ8RQT1DR
Content-Length: 43
Date: Thu, 29 May 2025 02:58:15 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MB8SB3PB-1T-50D4&ex=d-rubiconproject.com&status=ok&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
px.ads.linkedin.com/ Frame EDFA
Redirect Chain

https://token.rubiconproject.com/token?pid=36584&us_privacy=1NNY
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB8SB3PB-1T-50D4&us_privacy=1NNY

0
144 B

144ms
143ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB8SB3PB-1T-50D4&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: CF6CC1B6BE0648AAAA03453C7E63983A Ref B: LAX311000108049 Ref C: 2025-05-29T02:58:15Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2PXgQqUxayyaDQuIrCw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 02:58:14 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB8SB3PB-1T-50D4&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4581d8330ee81d8f36e15dba6d5b7f41
Pragma: no-cache
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EDFA
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n&us_privacy=1NNY
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjcwZWU0MmViMmU1OTkzZGY3YTdmNzE3YTRhZjlhOWI2YTFlMjM4OA&us_privacy=1NNY

170 B
188 B

367ms
367ms

Image
image/png

142.251.40.194
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjcwZWU0MmViMmU1OTkzZGY3YTdmNzE3YTRhZjlhOWI2YTFlMjM4OA&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.40.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 02:58:15 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjcwZWU0MmViMmU1OTkzZGY3YTdmNzE3YTRhZjlhOWI2YTFlMjM4OA&us_privacy=1NNY
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4581d8330ee81d8f36e15dba6d5b7f41
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame EDFA 43 B
855 B 751ms
308ms Image
image/gif 54.239.38.253
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.239.38.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: BEDJRWE4TFSCA4S14FGY
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 02:58:15 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame EDFA
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACL5U7Qb5sAABufcokY9A&expires=30

42 B
1 KB

1213ms
960ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACL5U7Qb5sAABufcokY9A&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AACL5U7Qb5sAABufcokY9A&expires=30
Content-Length: 0
Date: Thu, 29 May 2025 02:58:15 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

204

merge
ce.lijit.com/ Frame EDFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn&us_privacy=1NNY
https://ce.lijit.com/merge?pid=80&3pid=MB8SB3PB-1T-50D4&us_privacy=1NNY

0
223 B

1364ms
132ms

Image
text/plain

52.54.72.131
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=MB8SB3PB-1T-50D4&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.54.72.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-72-131.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

expires: Fri, 20 Mar 2009 00:00:00 GMT
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 02:58:16 GMT
pragma: no-cache
vary: Accept-Encoding
x-merge: CCPA Optout true

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ce.lijit.com/merge?pid=80&3pid=MB8SB3PB-1T-50D4&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 966e54b6201ecd300c4db0efc0f5781a
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
capi.connatix.com/us/ Frame EDFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564&us_privacy=1NNY
https://capi.connatix.com/us/pixel?puid=MB8SB3PB-1T-50D4&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY

0
329 B

182ms
91ms

Image
text/plain

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MB8SB3PB-1T-50D4&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.41.104 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 9472baa76d312ec6-LAX
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Thu, 29 May 2025 02:58:16 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MB8SB3PB-1T-50D4&pId=11&gdpr=&gdpr_consent=&us_privacy=&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19c1ac3b9706c83a73951eba4d239689
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame EDFA
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30&us_privacy=1NNY
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2420f52e-6bb0-4aed-ad03-b8b3f5bff81b&expires=30&us_privacy=1NNY

42 B
1 KB

880ms
748ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2420f52e-6bb0-4aed-ad03-b8b3f5bff81b&expires=30&us_privacy=1NNY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 574abe46412f7df61ec8713ff1a5b646
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: 000552aa-80df-40aa-a681-be6885b8c668
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=2420f52e-6bb0-4aed-ad03-b8b3f5bff81b&expires=30&us_privacy=1NNY
Content-Length: 164
Date: Thu, 29 May 2025 02:58:15 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

setuid
pbs.yahoo.com/ Frame EDFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-yahoo-exchange&us_privacy=1NNY
https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB8SB3PB-1T-50D4&us_privacy=1NNY

0
459 B

439ms
147ms

Image
text/html

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Download Go to Show image

Full URL

https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB8SB3PB-1T-50D4&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
x-envoy-upstream-service-time: 0
age: 0
x-envoy-decorator-operation: pbs--production-usea5.mediaplatform-gcp-prod-monetization.svc.cluster.local:4080/*
referrer-policy: no-referrer-when-downgrade
expires: 0
content-length: 0
date: Thu, 29 May 2025 02:58:16 GMT
content-type: text/html
vary: Origin,Accept-Encoding
server: ATS

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://pbs.yahoo.com/setuid?bidder=rubicon&uid=MB8SB3PB-1T-50D4&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 314e432eb2d967cf733b82bdbbe35231
content-length: 0
Content-Type: text/html

GET
H2

200

v1
match.sharethrough.com/sync/ Frame EDFA
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=18694&us_privacy=1NNY
https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB8SB3PB-1T-50D4&us_privacy=1NNY

68 B
323 B

880ms
880ms

Image
image/png

52.202.124.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB8SB3PB-1T-50D4&us_privacy=1NNY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

52.202.124.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
cache-control: no-cache
content-length: 68
content-type: image/png

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://match.sharethrough.com/sync/v1?source_id=UiRtTsXAfjmfSDAKnR1FjWsu&source_user_id=MB8SB3PB-1T-50D4&us_privacy=1NNY
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
content-length: 0
Content-Type: text/html

GET
H2 200 data.000000B9634144.js Show response
c.bannerflow.net/accounts/pandora/5bd804fe012f401e6cb9cd8c/published/11959676/14058591/ Frame 44E3 10 KB
3 KB 87ms
84ms Script
application/javascript 2606:4700::6811:6147
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://c.bannerflow.net/accounts/pandora/5bd804fe012f401e6cb9cd8c/published/11959676/14058591/data.000000B9634144.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/68110cc2c8c9e5ee932db79a?did=5ced17d285b1c200019c3fe1&&redirecturl=https%3A%2F%2Fad.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssfgbZs_txVXYpiYTlHHko8s0_JKzi_9l38B0-V7Z5R3HSwSyuOsC-yOG0aYkfI1-GGE97yep32XLbi0xvDK2530UzaRmbQUFbPu4EgMv1P5MoQTqdh_rHtDmkzubZQED1ghrAdfmA47vjcywIU8pJMQ0gTfYALAVy8g5F4WvExwIy5B8vzWZ6F8ued80nXv5vFSoWA5C5oaUJE4v9XFe-0_Kz0oDrE_q5ecia3R1lLroHQe7VKQiqGliSH1LIa5Z4D-aO0XT9OuwztXTPK6G8KHwwkFWI4nHhGLRak4yG65spADgqOMSRiYww_skuUWrlDA2MHbekgu9PdHX-1s4M1Asnr9xGtGbez8ny1oKqwDAxU-7GsLPTtb5mrzRAKjF2LRLSd7LPBZ4s4aSDBJkt-vny5Bu1JV4AEsVDmRFUIGN1KcCWAH5Cc9L4aTjK3qiOT5vjdrWaVhY2CWMqGtmiuisX5Pd0GX4lEBANRiUah6u6DuyZrDR1ur5raJ7SGbXELqG3i9Lj7maTRsGeB-BAv51Rz_baxufsT02EcjStCYuKpBs923GL6y0aiDrid-BukBKEi1dBdi4YJwQvL7mebL25Gi676rdDVlZURKbvG_1lM7wgIcVmMXOi6oqfp9GZwCEXs8IG0ZmP98oAkWJr0za9ep1sAYaYqC8J0n9LLJJsOeXWb1BIlQJ84_9awwwjjim13Ir2bn08kQPGOrJ0NhVMbhrCExyX56ixskRs-qgXECQalcVnt1QVasSrZVB6b_WX60slfEBdDzYaDKBZrM6xfk9QhcjQCcc80O4L7D7yq6GO5XMrZkb7ssKhWronAd7yAZwz6_GsiX6GDqg2sLbHKN3l4XQ8uB7paAuZUu9njHRLf1NB1iNGyzA4MvpXGqqYo8t9fL0WflCZL8DA5xD6wGG7ji8HagUFOSpFuojO3Qz4jeRWi7s6dkGss7U33Ht_LVbaasCWnVNdUPLBBhMUmc5OkNsbu8rUc_GoepHYZ31Cwm8pco8GQLfVRl9xgfDhocZInvbd9SbQ8fp150B9CjnpUNtQ-4oqe80zzmYcv0ynbMBC0oAW1qeWK3Zro1ZCFor_sH9COYOFAymarHq91iYDUI-NGXGFjthmz48YsXxJniFpbuZsjFe-QMpGzKZH9DelZK1voNfH5NmzYa8muVi1YVFcxJAU93BgO1jTjRzZKdXGFvZBgu3A0b7IkZqI10TzcO4gb26YlHuHBNwdfCT2Hv8qEU69NSjQ4UcfMdadwGylMSJwv9fubw_1scBRm5orqa0EGsThsA_yWVVlZEYCuCaaC9efHd6Tr6hHVOlYnXMAPhjw2h4sY-0_WnfVa84-Hq-hdgsNFm-KtYyemeLM9SFQEuzFaqJQZVdmcgiDpqPQ0VYpeo_cbHyjvOdNAPnz6l9tKV1S4VmK8dCY3GHeI4fLOc1jJDvw6jG2iEc763apYNetyrWy3pg_MoJLqrW-OtJKHgIdJ7CHc3DS8K2Ovj6lniJleLuLfsSRRjp3Wu3duSvza_AvJUKJgzGfJwNw3hRXaJHZzjTwAnsjtdn1SvrwYrsVy3lpS_7jLGwQQCnqOniW0DtD9iyqax2W8oyzKqeus5HfTfstbVsCgr_CDTBJuhpPG1Ljv7YVfF_TqnVtU6Wlp_cqai0nXqns2fZ0NTg3KTGYvpknnadEJiMYFql6O6Hls-Ihxe-_OnHTrh5TtDLtU3YAKayWvvfDOmAsn7kTR-2OnPkAq0DpPNlF8xjJbp4EYNe78bIk9wN6aaAJ0HsKtfOQUYI-CPpVWLbB1gLvO-2TrnMXy66NpYAjYsRRnQkJqS657cXULg-jLnOL1hQwsTp-7vJFFEJfFsku3NZn_BjXGVsbDA9nYBg053I6yee1TPsDQd7bcWr6-QVg8_LIgrQDn7eT6nvFVGRn9gj5QZokfnLJE6vCzvnw-CDJ1rEDGJg%26sai%3DAMfl-YS-Cgt4MMOmw3vEW2_vg6IlhKlE2WmFhJE_P7JCDrzFhV5vQjhG5b3ShWoc-BvtBVQwEo29qSiR1NB4LY-NW_dbkP_3wRf4Fbm5PVArxLThnOk81EKkykR2KGLEwNSd-fKbuDOFVr3V0OkEzTglkp9YOXZBFmzc4pc0PeTwX5LTrPdTI6_kPx-TdYoImo7wujCMsfs7xCb_oIa4aad6jbavwLynGnzXCOL6D8mhUEEPypFYdWXifIyEcP7mvCOHOprjHsFnrt-6G-LZI8Qy8Gzl%26sig%3DCg0ArKJSzBHYRXt9v8XGEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26crd%3DaHR0cHM6Ly9wYW5kb3JhLm5ldA%26urlfix%3D1%26rm_eid%3D%255Brm_exit_id%255D%26adurl%3Dhttps%253A%252F%252Fus.pandora.net%252Fen%252Fcollections%252Fpandora-essence%252F%253Fcid%253Ddisp%253Adv360%253A%253Aessence%253Amidfunnel%253Ano_promo%253A%253A%253A%253A%253A%253A%253Amixed%253A%253A%253A%253Abelove_summer%2526dclid%253D%2525edclid!%2526gad_source%253D7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6147 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe5dd3e4a661fb87b180578d9b45eb8db39a816af38313721386b280a26a5005

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

content-md5: /XJVrWZjFxH1yAezg6OISw==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
x-ms-lease-status: unlocked
etag: W/"0x8DD8743978A091A"
age: 601073
cf-cache-status: HIT
content-encoding: br
date: Thu, 29 May 2025 02:58:15 GMT
content-type: application/javascript
last-modified: Tue, 29 Apr 2025 17:30:53 GMT
vary: Accept-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-request-id: 6dd5e462-701e-0025-03ce-ca7caf000000
cf-ray: 9472ba9d5b7d0904-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H2 200 animated-creative.c15fbdca338b55002c24.js Show response
c.bannerflow.net/scripts/ Frame 44E3 165 KB
56 KB 90ms
88ms Script
application/javascript 2606:4700::6811:6147
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.c15fbdca338b55002c24.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/68110cc2c8c9e5ee932db79a?did=5ced17d285b1c200019c3fe1&&redirecturl=https%3A%2F%2Fad.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjssfgbZs_txVXYpiYTlHHko8s0_JKzi_9l38B0-V7Z5R3HSwSyuOsC-yOG0aYkfI1-GGE97yep32XLbi0xvDK2530UzaRmbQUFbPu4EgMv1P5MoQTqdh_rHtDmkzubZQED1ghrAdfmA47vjcywIU8pJMQ0gTfYALAVy8g5F4WvExwIy5B8vzWZ6F8ued80nXv5vFSoWA5C5oaUJE4v9XFe-0_Kz0oDrE_q5ecia3R1lLroHQe7VKQiqGliSH1LIa5Z4D-aO0XT9OuwztXTPK6G8KHwwkFWI4nHhGLRak4yG65spADgqOMSRiYww_skuUWrlDA2MHbekgu9PdHX-1s4M1Asnr9xGtGbez8ny1oKqwDAxU-7GsLPTtb5mrzRAKjF2LRLSd7LPBZ4s4aSDBJkt-vny5Bu1JV4AEsVDmRFUIGN1KcCWAH5Cc9L4aTjK3qiOT5vjdrWaVhY2CWMqGtmiuisX5Pd0GX4lEBANRiUah6u6DuyZrDR1ur5raJ7SGbXELqG3i9Lj7maTRsGeB-BAv51Rz_baxufsT02EcjStCYuKpBs923GL6y0aiDrid-BukBKEi1dBdi4YJwQvL7mebL25Gi676rdDVlZURKbvG_1lM7wgIcVmMXOi6oqfp9GZwCEXs8IG0ZmP98oAkWJr0za9ep1sAYaYqC8J0n9LLJJsOeXWb1BIlQJ84_9awwwjjim13Ir2bn08kQPGOrJ0NhVMbhrCExyX56ixskRs-qgXECQalcVnt1QVasSrZVB6b_WX60slfEBdDzYaDKBZrM6xfk9QhcjQCcc80O4L7D7yq6GO5XMrZkb7ssKhWronAd7yAZwz6_GsiX6GDqg2sLbHKN3l4XQ8uB7paAuZUu9njHRLf1NB1iNGyzA4MvpXGqqYo8t9fL0WflCZL8DA5xD6wGG7ji8HagUFOSpFuojO3Qz4jeRWi7s6dkGss7U33Ht_LVbaasCWnVNdUPLBBhMUmc5OkNsbu8rUc_GoepHYZ31Cwm8pco8GQLfVRl9xgfDhocZInvbd9SbQ8fp150B9CjnpUNtQ-4oqe80zzmYcv0ynbMBC0oAW1qeWK3Zro1ZCFor_sH9COYOFAymarHq91iYDUI-NGXGFjthmz48YsXxJniFpbuZsjFe-QMpGzKZH9DelZK1voNfH5NmzYa8muVi1YVFcxJAU93BgO1jTjRzZKdXGFvZBgu3A0b7IkZqI10TzcO4gb26YlHuHBNwdfCT2Hv8qEU69NSjQ4UcfMdadwGylMSJwv9fubw_1scBRm5orqa0EGsThsA_yWVVlZEYCuCaaC9efHd6Tr6hHVOlYnXMAPhjw2h4sY-0_WnfVa84-Hq-hdgsNFm-KtYyemeLM9SFQEuzFaqJQZVdmcgiDpqPQ0VYpeo_cbHyjvOdNAPnz6l9tKV1S4VmK8dCY3GHeI4fLOc1jJDvw6jG2iEc763apYNetyrWy3pg_MoJLqrW-OtJKHgIdJ7CHc3DS8K2Ovj6lniJleLuLfsSRRjp3Wu3duSvza_AvJUKJgzGfJwNw3hRXaJHZzjTwAnsjtdn1SvrwYrsVy3lpS_7jLGwQQCnqOniW0DtD9iyqax2W8oyzKqeus5HfTfstbVsCgr_CDTBJuhpPG1Ljv7YVfF_TqnVtU6Wlp_cqai0nXqns2fZ0NTg3KTGYvpknnadEJiMYFql6O6Hls-Ihxe-_OnHTrh5TtDLtU3YAKayWvvfDOmAsn7kTR-2OnPkAq0DpPNlF8xjJbp4EYNe78bIk9wN6aaAJ0HsKtfOQUYI-CPpVWLbB1gLvO-2TrnMXy66NpYAjYsRRnQkJqS657cXULg-jLnOL1hQwsTp-7vJFFEJfFsku3NZn_BjXGVsbDA9nYBg053I6yee1TPsDQd7bcWr6-QVg8_LIgrQDn7eT6nvFVGRn9gj5QZokfnLJE6vCzvnw-CDJ1rEDGJg%26sai%3DAMfl-YS-Cgt4MMOmw3vEW2_vg6IlhKlE2WmFhJE_P7JCDrzFhV5vQjhG5b3ShWoc-BvtBVQwEo29qSiR1NB4LY-NW_dbkP_3wRf4Fbm5PVArxLThnOk81EKkykR2KGLEwNSd-fKbuDOFVr3V0OkEzTglkp9YOXZBFmzc4pc0PeTwX5LTrPdTI6_kPx-TdYoImo7wujCMsfs7xCb_oIa4aad6jbavwLynGnzXCOL6D8mhUEEPypFYdWXifIyEcP7mvCOHOprjHsFnrt-6G-LZI8Qy8Gzl%26sig%3DCg0ArKJSzBHYRXt9v8XGEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26crd%3DaHR0cHM6Ly9wYW5kb3JhLm5ldA%26urlfix%3D1%26rm_eid%3D%255Brm_exit_id%255D%26adurl%3Dhttps%253A%252F%252Fus.pandora.net%252Fen%252Fcollections%252Fpandora-essence%252F%253Fcid%253Ddisp%253Adv360%253A%253Aessence%253Amidfunnel%253Ano_promo%253A%253A%253A%253A%253A%253A%253Amixed%253A%253A%253A%253Abelove_summer%2526dclid%253D%2525edclid!%2526gad_source%253D7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:6147 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7416d7105d625bfa36e7fa6431dc02de89146c2acae686403b3ab1cd0c59868e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://s0.2mdn.net/

Response headers

content-md5: HDAEWWdrIbkoYlpIyIvZog==
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
x-ms-lease-status: unlocked
etag: W/"0x8DD86F643759021"
age: 1087201
cf-cache-status: HIT
content-encoding: br
date: Thu, 29 May 2025 02:58:15 GMT
content-type: application/javascript
last-modified: Tue, 29 Apr 2025 08:17:20 GMT
vary: Accept-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-request-id: 9970f9a7-201e-004a-596d-ba765c000000
cf-ray: 9472ba9d5b7f0904-LAX
access-control-allow-origin: *
x-ms-blob-type: BlockBlob
server: cloudflare

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 740B 42 B
65 B 165ms
164ms Fetch
image/gif 172.217.165.130
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuwRksdFbP3zdEqI2S-UKvKYfUymuPBGUZqOsVh_3QdwLIpJTgVO5pVZ3PqV72do7jmUoBBE0iaxCEft85EkPY766dgvQVWJp_zB5G9ZGHGhQtBofoQnkZknYInlqhZSZ1zD98s2VGMeJ7kOT5a3h4MHrb-N1_OCWshQXtae5TR8LNArqMTFMOQ4zOWyfLnDF-RWWFuASSn&sai=AMfl-YRUH4Tgm4iK4bstBqaOFFrOWszbOw7qQO4_Cofbxo2sfRHPyfPYEOdQAQDKMva0wCoeXWgDRxQl8-67DChOyBjLQ0naga3zGW4pmIUr_Of1swKtV08wd7Tfld4&sig=Cg0ArKJSzHcjHjbgblBxEAE&cid=CAQSOwDZpuyzob_N3-5V2ex38av33l2HSMSuTYrXRsiTqrruefmCPUcSRZMXQR1o-WIeFLt3yTRyOVX1P1wUGAE&id=lidar2&mcvt=1004&p=313,20,913,180&tm=1208.400001525879&tu=204.4000015258789&mtos=499,1004,1004,1004,1004&tos=499,505,0,0,0&v=20250528&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2747221344&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4442029400&rst=1748487493229&rpt=1019&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS