paint.toys
15.197.167.90 Public Scan Open in urlscan Pro

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 17210
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1665
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 07:58:18 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JWDGS4J4MMREEMWXER2TGT8K

Redirect headers

accept-ranges: bytes
age: 17210
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 07:58:18 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JWDGS4G3ZN5T10PBYRKA1JNE

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 35 KB
6 KB 202ms
86ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6506dbeab38416664f26cc49c4b7c3e9dfa483a00a93b5b5053fe085378cc0aa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-ray: 947472249bc05e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 41ms
40ms Stylesheet
text/css 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 24221
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JWDGS4K9NN6QGQR8RHWJEEN0
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 43ms
42ms Script
application/javascript 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 18987
accept-ranges: bytes
content-length: 1190
x-nf-request-id: 01JWDGS4K9QYQRF70S6NARQ1VV
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 45ms
44ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 24221
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JWDGS4KNYXXKH7NV7ZH9JT4D
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 44ms
44ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 24221
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JWDGS4KNY2JSRY71JE72K6RD
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 34ms
32ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 24221
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JWDGS4MQNQ0VZ5Q6AE4PM1R9
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 45ms
43ms Image
image/png 15.197.167.90
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.197.167.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 13483
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JWDGS4N4D8PMT3CRVCE26JCV
cache-status: "Netlify Edge"; hit
date: Thu, 29 May 2025 07:58:18 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 120ms
50ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3bd49fee48f649818d0cb1667aebb44296b2352bd4cbf0241320403acd7a97

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 947472249bc15e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 371 KB
125 KB 175ms
64ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5d886a1b22750815ccb5b79b705b86955ac43ee27c31f31c2953bcdf412eee2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 07:58:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 127645
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 l5fne80l3kwl-prod.js Show response
faucetfoot.com/scripts/ 68 KB
25 KB 221ms
84ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/scripts/l5fne80l3kwl-prod.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

a3fb723badc47fa98674589dc63545281f9a3ff1d95ae1de35048690f301955e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"7908bb0dc39aef5de04b2dd3838e87adb35f069e0beed8b23cef0c5a11d06d66"
via: fen-hoothoot-us-east1-chmc.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1797731198

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 109 KB
34 KB 215ms
84ms Script
text/javascript 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4017804fbe04b69a58d3c2200d42529d1244f0946b17f7f3cb1348c4d9a79183

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 868 / 20237 / m202505200101 / config-hash: 3385491783623399952
x-content-type-options: nosniff
expires: Thu, 29 May 2025 07:58:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34392
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 589 KB
180 KB 60ms
56ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8110ded3886a93d34096358d663e7c487101a735b4720a076ed8ba4af6f00f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"369edfdc43d190015e70ab72de8421b6"
age: 6477
cf-ray: 947472254bf85e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript
last-modified: Tue, 27 May 2025 18:09:54 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 411 B
335 B 120ms
117ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 873077f505ed9a2ab737917ab1975a275fe12309a5d3342cdd9abf68a05d672f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"7fd9352c65db194dec16fb4e09a7fa99"
age: 5323
cf-ray: 947472258c0d5e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:42 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
413 B 144ms
45ms Script
application/javascript 2606:4700::6812:19f2
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:19f2 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1fe3f4780c30c13bfb4d9c944f8c26276b7e58dd800424e4214654a5e798954f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 94747225ec0143b9-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 314 KB
111 KB 55ms
54ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55r0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

219c85e7b5ac67e527cf87d773b293f9220945bfe3804280315558036027ee1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 07:58:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 113682
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 219ms
96ms Fetch
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je55r0v9101576445za200&_p=1748505498214&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&cid=1018157918.1748505499&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748505498&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsadv.rigaprecast.com%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=935
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 runtime.a088001b29a202d4ae31.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 3 KB
2 KB 42ms
41ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 02e387c0ca7dad9064b8cd6c46d54be6c716d687db0f5554c567b1a8215620cb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"83c44cf57817ee03c45b0f60d411b58b"
age: 5321
cf-ray: 947472260c485e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:44 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.80efcc48269da6666d6e.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 521 KB
158 KB 48ms
48ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cc875e681008e74d84ab9c500342af1938c8b50551cf5b1bf87b3310ad9e8d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"834b7930c1bf650af83c3fc3cb164788"
age: 5322
cf-ray: 947472260c495e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:40 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 40ms
39ms Fetch
text/plain 2607:f8b0:4004:c09::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je55r0v9102396898za200zb9101576445&_p=1748505498214&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&ptag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635&cid=1018157918.1748505499&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1748505498&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsadv.rigaprecast.com%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1748505498214&tfd=1119
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je55r0v9101576445za200&tag_exp=101509157~103116026~103130498~103130500~103200004~103233427~103252644~103252646~104481633~104481635
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c09::8a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:100:0
report-to: {"group":"ascnsrsggc:100:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:100:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:100:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 559 B
440 B 43ms
43ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 5321
cf-ray: 94747227bd185e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:18 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame 2A7E 503 B
429 B 281ms
60ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3345fb969ca2f2bfdbe013d5977ea8bc8326c87ec220290f568ad1257ebfc4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 5323
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 947472293d4343b9-EWR
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
hw-country-code: US
last-modified: Wed, 28 May 2025 16:25:37 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame D54E 503 B
0 279ms
279ms Document
text/html 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e3345fb969ca2f2bfdbe013d5977ea8bc8326c87ec220290f568ad1257ebfc4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 5323
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 947472293d4343b9-EWR
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
hw-country-code: US
last-modified: Wed, 28 May 2025 16:25:37 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/3/desktop/Chrome/ 586 B
921 B 324ms
101ms XHR
application/json 2600:9000:215f:5e00:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Thu/3/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:215f:5e00:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f8c97405460174c8100d015c1206f843c449cf2cc77856e47d43d860b84227bc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 3480
via: 1.1 036a9c4a824b984cd31ef0e9e0ecd306.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 586
x-amz-cf-id: CLCcb_VkC9azzoiUS5wbKpE5ng3aQqRfK1PNJ021VIPvxzUU1C1kQQ==
date: Thu, 29 May 2025 07:00:19 GMT
content-type: application/json
x-amz-cf-pop: YUL62-C2
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 147 KB
39 KB 162ms
55ms Script
application/javascript 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c6ef163d29f17126aa27a4c8508a08b53eb1f67680d3e22d7d2cc11f6cf8d26

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "fa4592365bccd213c9a48f3d23404125"
via: 1.1 google
cf-ray: 947472288c594544-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39462
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/javascript
last-modified: Thu, 29 May 2025 07:52:59 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 380 KB
92 KB 164ms
58ms Script
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0ae597c862464cf3f93f27ed75e5ccad9de4d42e78e0c6bab716c1adcf6c7a67

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"0d3ee470bc13a3093281c3682e3795e1"
age: 2041
via: 1.1 a1157b69a14bebe8162237750a074fae.cloudfront.net (CloudFront), 1.1 a035f6df76b0fcf3f3f167c837fad7ee.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 1O_HmpmkGyHAI96kJp4Dc75bletl2EY90XXQUi1Lk6cnaCNOBLjdqw==
date: Thu, 29 May 2025 07:24:18 GMT
content-type: application/javascript
last-modified: Wed, 28 May 2025 20:29:48 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3, IAD89-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
587 B 196ms
95ms Image
image/gif 2606:50c0:8000::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8000::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: 23d1b132bcba304c4fb32bdbb213b31a60341713
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 60CF:2FAAA5:16C9F4:1C235C:6835BCC4
expires: Thu, 29 May 2025 08:03:18 GMT
x-cache: HIT
date: Thu, 29 May 2025 07:58:18 GMT
content-type: image/gif
x-served-by: cache-ewr-kewr1740076-EWR
x-cache-hits: 12
source-age: 229
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1748505499.971735,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 190ms
57ms Script
text/javascript 3.162.3.84
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-84.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 47893
via: 1.1 60d690eb8aefecb50f44bbe348e3804a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: WoPWAjhrgYzEAdJBIcnh5VM58-sHHylwpGhf-ZWE2Th5_-m2AB9QuA==
date: Wed, 28 May 2025 18:40:07 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/ 539 KB
170 KB 41ms
40ms Script
text/javascript 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

638b32a4f2339ff4f58198fe56ffb89091e03c23d76a39821797c01f026e21ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8367355567805738573
age: 2983
x-content-type-options: nosniff
expires: Fri, 29 May 2026 07:08:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 07:08:35 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 173743
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
480 B 242ms
92ms Image
image/gif 2600:9000:25c8:c600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=823638_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:25c8:c600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 48121
x-cache: Hit from cloudfront
x-amz-cf-id: MvjISy2fv7PBoKgha7KKwyMciB05uozkDZ03XHOmZZtqxl9velmxlA==
date: Wed, 28 May 2025 18:36:19 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 2a78cba32e1e70413cb851835f0eb89c.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: PHL51-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/ 63 KB
23 KB 153ms
150ms Other
text/plain 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202505270101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b502c40cea58eb57328f78cf48c787ab82d46606203a135bbb813ee19fb6c6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 8651680878418282224
age: 61015
x-content-type-options: nosniff
expires: Wed, 04 Jun 2025 15:01:24 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 28 May 2025 15:01:24 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23432
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202505270101"

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
234 B 199ms
89ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
549 B 157ms
44ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 951621
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 94747229f879d218-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 120ms
38ms Image
image/x-icon 142.251.111.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.111.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bk-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 26077
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 30 May 2025 00:43:42 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 00:43:42 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
110 B 200ms
88ms Image
image/gif 2606:4700:10::6816:441
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.29330802146326984
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:441 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 951621
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 94747229f87bd218-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 120ms
30ms XHR
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 27952
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: R-GQDFhenbHDt6e1in1ClGV04hrOBy07bJIX8p8qJY4yj0ViNz-RlQ==
date: Thu, 29 May 2025 00:12:28 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 a3d7bfd4ff510fbf1dac72ccd39441fe.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
829 B 142ms
45ms Script
application/javascript 18.160.10.101
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.101 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-101.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 498
via: 1.1 76e55a2361219fb19722e949475d1844.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: 1bmSivlMhbAiGSm-WWAyPNVcFraM3IM5RpoPlqxMbPg6ymeim1g8xw==
date: Thu, 29 May 2025 07:50:01 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 46ms
45ms XHR
application/json 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 2907
access-control-allow-credentials: true
via: 1.1 a035f6df76b0fcf3f3f167c837fad7ee.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: IcpVZG4kGA321syzDmntW7uVng7ghYwRKMF1vISSVxA4PNW3RpE8bg==
date: Thu, 29 May 2025 07:09:51 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD89-P3
server: Server

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame 2A7E 17 KB
7 KB 46ms
45ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 5323
cf-ray: 94747229bd7543b9-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250528.1/iframe/ Frame D54E 17 KB
0 42ms
42ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250528.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 5323
cf-ray: 94747229bd7543b9-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:38 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 203 KB
66 KB 212ms
85ms Script
application/javascript 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

17a142062bf2f602b30a144a514ea3f95889fafd1b1f6c94554bdfc156fa5fc8

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-93av_xTbHPSwWH3AaFh4rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytDikmJw1ZBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8JpN1lTgXjXxlush4G4Sfs2axcQm_ndZrUDYiEejtnLHxxkE1ixr_Ewo5JGUn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUbyRgZGpgamRuZ6BcXyBAQDJyT-b"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-93av_xTbHPSwWH3AaFh4rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 171ms
55ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qsadv.rigaprecast.com
URL: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 29 May 2025 08:13:19 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 29 May 2025 07:58:19 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 47ms
45ms Script
text/javascript 3.162.3.84
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qsadv.rigaprecast.com
URL: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.3.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-3-84.yul62.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 84120
via: 1.1 60d690eb8aefecb50f44bbe348e3804a.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: r6vw0uOFxsjCS4Xp6999M7o64YG3P30XR79-vWZqLMBcum0V8eoArw==
date: Wed, 28 May 2025 08:36:19 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: YUL62-P2
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 173ms
62ms Script
text/javascript 2606:4700:10::ac43:246e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&_it=amazon&partner_id=403
Requested by: Host: qsadv.rigaprecast.com
URL: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:246e -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 1743
cf-ray: 9474722b1e3b0866-EWR
x-amz-request-id: 620H5FH7PQY89SMY
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
server: cloudflare
x-amz-id-2: J5ofm6SXdNG0FFtc1wmm7e4b0Q8d9MUgIfU0clxuW74exfDSGWFW0Mkvu0uHy8awrrcUjLeuQvo=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
30 KB 192ms
73ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

860539ec4f3ee0e11aa746e6d001bfce5654a5b6101563e17cfa4716cfdc4335

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-amz-id-2: 85QnfcZfTzJ/QIXPG5Kvl2tSMRKN3ree4o1T1IGonFelTogjf8SoroydpHpsnKMd3MFP1SpPKxZzgsysP4c7yg==
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
content-encoding: br
cf-cache-status: HIT
etag: W/"dcb8906065544836970a0fd171e6738e"
age: 2441
x-amz-request-id: CB7VXS96M20YY7QP
cf-ray: 9474722b1a97a62e-EWR
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript;charset=utf-8
last-modified: Fri, 02 May 2025 06:44:22 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 196ms
82ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qsadv.rigaprecast.com
URL: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 29 May 2025 08:13:19 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 29 May 2025 07:58:19 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET 7c598bae-deef-4c49-a05f-14eec6ce6377
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 231ms
95ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 07:58:19 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 210546
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 176ms
68ms XHR
application/json 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49e1b91d6189f25536b2efedbd89cbc48afe724f8b06b70a4f12ca7c5c0a033e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 54926
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Wed, 28 May 2025 12:11:06 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 9474722b2c000f63-EWR
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250528.1/ 3 KB
1 KB 36ms
35ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250528.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/runtime.a088001b29a202d4ae31.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 5323
cf-ray: 9474722a7e625e86-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript
last-modified: Wed, 28 May 2025 16:25:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 189ms
64ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qsadv.rigaprecast.com
URL: https://qsadv.rigaprecast.com/c6sabmgjzsmgequokdRaFFvTk5YWkdpTHVaQVpZYnpzWFItMzE5NC0yNjc1MjI4MS0wZmY1MDI3My00OTcyLXFWZmNKMVhNQ1FZeUhrUGNOSTQ2/lvs9vn2d222l0/JO7zP2MBma7JTBq2QtRej7pl/569617
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 141d4db367a3676cb15ead84541ed2c8d2205cbfef84a6b69952b1897fcc88f9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 447 KB
141 KB 209ms
85ms Script
text/javascript 2607:f8b0:4004:c1f::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a0d8647aeab78d89cb0c09509b13d78b932a9491a09aae58c4840660f22bef7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 5341538035048807860
x-content-type-options: nosniff
expires: Thu, 29 May 2025 07:58:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 144316
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 514ms
192ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-100-29-97-158.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 07:58:18 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
777 B 240ms
86ms Fetch
application/json 34.193.179.5
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.179.5 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-179-5.compute-1.amazonaws.com
Software: /
Resource Hash: 4e4a7b1d41dc57cf3ca93690877938df76840a4ba16342c96b6de6e4321ed7b2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
684 B 334ms
137ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: aac3ccdaa8f389b711664aa779748da2b8641df207647af3be2113169af45afa

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 235ms
86ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 81b2f9e43964a5f88a4664ce40a3c9b53bb38f034ffbd68e8c65cb9fa1cd0e7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 517 B
931 B 235ms
86ms Fetch
text/plain 100.29.97.158
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

100.29.97.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

c72319f4e9833a24f39a18b994fc11302b6e5ce9e8959f8e8efd94b124e0c925

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 523e5d09634f8ffb
request-time: 3
access-control-allow-credentials: true
expires: Fri, 30 May 2025 07:58:19 GMT
access-control-allow-origin: https://paint.toys
content-length: 517
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=FOdlPnxYUExFVGxLcGp1WW10L0JQVjlnSSt5Wm5FY25YanQ1Y0NENmZITnRDandaSnNONlhSQVFRZWMzanJvSEtRUnVNZ1ZQZWwxQS9pbU5ua2pLQ3NmTkd1MXBUcnFqUDArQ0ptb2xDZU9hanBNdWt0QXJZWktQZG5qTT...

359 B
933 B

206ms
83ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=FOdlPnxYUExFVGxLcGp1WW10L0JQVjlnSSt5Wm5FY25YanQ1Y0NENmZITnRDandaSnNONlhSQVFRZWMzanJvSEtRUnVNZ1ZQZWwxQS9pbU5ua2pLQ3NmTkd1MXBUcnFqUDArQ0ptb2xDZU9hanBNdWt0QXJZWktQZG5qTTRzUXB5UFhiL3lCV29naFlnU2RHa3hRY0ZxOTRxdzY4NzdBQndnaUN2aFJzTW42V3hkREh6azdJWmJLdVZ2ek9rNFRGWTFoUk9PSjZFbkoxL1poc08zcWZCamUyN3llc0RmbzEzRENtVXBGM2o0T1h6WVNxQ1VTb2ZkeGlWTGV5WFFhZ24yZzZUfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1e4432810a72bfb44898bb2607db947d1bf6d9e29fc798b1f65406d28df19f0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 476466
expires: 0
access-control-allow-origin: null
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=FOdlPnxYUExFVGxLcGp1WW10L0JQVjlnSSt5Wm5FY25YanQ1Y0NENmZITnRDandaSnNONlhSQVFRZWMzanJvSEtRUnVNZ1ZQZWwxQS9pbU5ua2pLQ3NmTkd1MXBUcnFqUDArQ0ptb2xDZU9hanBNdWt0QXJZWktQZG5qTTRzUXB5UFhiL3lCV29naFlnU2RHa3hRY0ZxOTRxdzY4NzdBQndnaUN2aFJzTW42V3hkREh6azdJWmJLdVZ2ek9rNFRGWTFoUk9PSjZFbkoxL1poc08zcWZCamUyN3llc0RmbzEzRENtVXBGM2o0T1h6WVNxQ1VTb2ZkeGlWTGV5WFFhZ24yZzZUfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 290454
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 07:58:19 GMT
server: Kestrel

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 1 KB
816 B 685ms
432ms Fetch
application/json 3.161.214.59
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqsadv.rigaprecast.com%2F&pid=pVJy1kmfyLXsP&cb=0&ws=1600x1200&v=25.527.1456&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=6930f2d3-6951-4d24-bdcc-e15d81b9f3c3&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.214.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-214-59.yul62.r.cloudfront.net
Software: Server /
Resource Hash: e11fd73292a85a655e23ef0c140938542ee0755789bef6507b4b7c549637ba56

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 a6f2e7c3dd76750ec70d32e7fcf09838.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 483
x-amz-cf-id: 3_UZQCxBhMuaRGgTBSfkuyeIh78FHwL6Wp-f5Ys1yT7pyUIBljcEqA==
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: YUL62-P1
server: Server

GET
H2 200 country Show response
api.btloader.com/ 37 B
154 B 253ms
118ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 246ms
116ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=QnX7JbEVz3-FSX0wZen1B-971b0c95ad&sid=WPZYftHPr-Z6oIKI7vLI-971b0c95ad&cv=2.1.102-1-g48599ff&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:19 GMT
vary: Origin

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_3266c96d-ce67-4d1b-bbb0-de35451d156e_1748505499258
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfMzI2NmM5NmQtY2U2Ny00ZDFiLWJiYjAtZGUzNTQ1MWQxNTZlXzE3NDg1MDU0OTkyNTgQABoNCJun4MEGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=be88119e32298b5dba81caa75bdee39d4e5df67f4ab694c6d9aa78984ced88f0791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=be88119e32298b5dba81caa75bdee39d4e5df67f4ab694c6d9aa78984ced88f0791426b5417dce21&rand=06182377
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=be88119e32298b5dba81caa75bdee39d4e5df67f4ab694c6d9aa78984ced88f0791426b5417dce21&rand=06182377&expected_cookie=280f6185-c3a8-4c91-8d12-99f9764d07bd

0
143 B

109ms
107ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=be88119e32298b5dba81caa75bdee39d4e5df67f4ab694c6d9aa78984ced88f0791426b5417dce21&rand=06182377&expected_cookie=280f6185-c3a8-4c91-8d12-99f9764d07bd
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: D51FB7A8EB574B8C859FA3066DA5E6EF Ref B: PHL30EDGE0414 Ref C: 2025-05-29T07:58:20Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2Qak7m3vgcK1AU+2C4w==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
location: /db_sync?pid=10339&puuid=be88119e32298b5dba81caa75bdee39d4e5df67f4ab694c6d9aa78984ced88f0791426b5417dce21&rand=06182377&expected_cookie=280f6185-c3a8-4c91-8d12-99f9764d07bd
x-msedge-ref: Ref A: 9D12B11D28A34CC394604CB8EB55E916 Ref B: PHL30EDGE0414 Ref C: 2025-05-29T07:58:20Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2Qak56HAFwexDC029vQ==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_3266c96d-ce67-4d1b-bbb0-de35451d156e_1748505499258
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_3266c96d-ce67-4d1b-bbb0-de35451d156e_1748505499258

1 KB
2 KB

72ms
72ms

Script
application/javascript

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_3266c96d-ce67-4d1b-bbb0-de35451d156e_1748505499258
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: 6fb709e9ce54e49e5f340d9b56156634939df3107e7e55cb4c24f981833c43ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:19 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_3266c96d-ce67-4d1b-bbb0-de35451d156e_1748505499258
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:19 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
446 B 264ms
94ms XHR
application/json 184.73.75.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.73.75.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-75-189.compute-1.amazonaws.com
Software: /
Resource Hash: 5f5e4bfb99f14d8cf321569dc8c2e67a50e617b7af3cf90a459fb78b67140830

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=utf-8

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 156 B
486 B 292ms
121ms XHR
application/json 184.73.75.189
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 184.73.75.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-75-189.compute-1.amazonaws.com
Software: /
Resource Hash: 5c31b3b6ade70a63eacdcb63d3581de859e221b4249c497c486f7a00e69ad650

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 156
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame 69F9 1 KB
2 KB 270ms
76ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 3370
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 07:02:09 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: ABgVH8_X8XwePUgh0p3tEJvsdbtB6COIApAL0Kh_MVKQHSs2hMc2IfxJXGCxsd0w2WEm8waN

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 1672 2 KB
1 KB 304ms
73ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=87534
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
expires: Fri, 30 May 2025 08:17:13 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 245ms
87ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d0b4b1ad8646f6ce4465997680eaa3a060b37f3d227154a23fb5fc43db2d9e2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748505499&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JhVdSoj5imu2d%2FbEip%2FMULt082x4qKg7A18a%2F9nknF0%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748505499&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JhVdSoj5imu2d%2FbEip%2FMULt082x4qKg7A18a%2F9nknF0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9474722c7ec84f0b-EWR
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 268 KB
92 KB 1842ms
1694ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8853c55564ba75a4eb5693ee0686eb81246bb39ae615f31ddc1460a94769496f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748505499&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JhVdSoj5imu2d%2FbEip%2FMULt082x4qKg7A18a%2F9nknF0%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:21 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748505499&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=JhVdSoj5imu2d%2FbEip%2FMULt082x4qKg7A18a%2F9nknF0%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 9474722c7ec94f0b-EWR
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 264ms
75ms Fetch
application/json 199.250.161.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.161.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 480 B
667 B 631ms
380ms Fetch
application/json 18.207.157.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.207.157.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

61065d9f4e7f1a1a214f7cd89a5fb898429f972771cf208893b69e3dc1fc0710

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 311
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 200 v1 Show response
btlr.sharethrough.com/universal/ 663 B
774 B 469ms
217ms Fetch
application/json 18.207.157.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.207.157.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

0c7ab8ffed614ed6ebea3e6f5fdfaa8a187a3f8bf54389e2c78ff19b287c4ff7

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.5
strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
content-encoding: gzip
content-length: 418
content-type: application/json; charset=utf-8
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 448ms
196ms Fetch 18.207.157.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.207.157.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 357ms
105ms Fetch 18.207.157.141
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.207.157.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 80 KB
10 KB 442ms
235ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9de10c1919fb920b2e1931fbf945422c885e318f0d9253677e355917b8f214ae

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2erLdMv1hI6%2BOVjfYnibm1if52K0bTDmJqQDZ%2B0q8h5iCKiTXkHADEyCZwwYI%2BZJzZy0bnelOW022aEedUsUAqoPE8X6SIBNTMmpXJ0agZjBsVjLWOBUKQy0lfL4xd0CiKzy5Q%2B"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 9474722cfc3d0f79-EWR
access-control-allow-origin: https://paint.toys
content-length: 9882
server: cloudflare

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
581 B 318ms
116ms Fetch
application/json 68.67.181.231
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.231 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.134; 206.66.99.134; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: 2987c428-be25-46a3-8a33-43bfc0a7e9dd
content-length: 19
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:19 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 703 B
1 KB 319ms
147ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=1a585a80-4ecc-4eaa-8528-25a5242cea18%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=05cba899-beaa-405a-9fbb-4342e9ad866c%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a667a40b-ff6b-4a4d-8f45-d9e61875b5e4&l_pb_bid_id=83581a9b9bdc68d&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=f0156484-2b8d-4df9-87da-0a0de923a617&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.17246689600810483
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 54dc9fd28c2b13b1518e1f0cc4957e54cbb6e94d50cce87f778d77a4e15726ad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 535 B
887 B 329ms
158ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=1a585a80-4ecc-4eaa-8528-25a5242cea18%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=05cba899-beaa-405a-9fbb-4342e9ad866c%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a667a40b-ff6b-4a4d-8f45-d9e61875b5e4&l_pb_bid_id=843a6aebd4e93148&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=a095166c-1282-4bb1-808a-fe1167d8c785&p_site.mobile=0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.09676233551490232
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: c2d0ee35854c69b8187255c414c9c27b01bcb27ab72a9ba2b4e405f20a90b6fe

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 535
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 541 B
893 B 324ms
154ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=1a585a80-4ecc-4eaa-8528-25a5242cea18%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=05cba899-beaa-405a-9fbb-4342e9ad866c%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a667a40b-ff6b-4a4d-8f45-d9e61875b5e4&l_pb_bid_id=85359a6eafd45fa8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=92147062-0724-4f94-971f-b6ea8d048d2e&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.7471297437448331
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 91f5de6b746de963a35b07971394a8d2b836f248eaa58ab7bd8ab6f0e78567f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 541
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 541 B
892 B 323ms
153ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=1a585a80-4ecc-4eaa-8528-25a5242cea18%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=05cba899-beaa-405a-9fbb-4342e9ad866c%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a667a40b-ff6b-4a4d-8f45-d9e61875b5e4&l_pb_bid_id=86d8005bafe1b24&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=816781b0-0e31-4410-8ac1-654e036ba307&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.30610023897731997
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 2215d623b58984fd62661f72af5eac35ae8c2bc4f18ae6e78eca58d316298f68

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 541
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 276 KB
127 KB 659ms
425ms Fetch
application/json 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 1d289bac83531d26a3d682f1d08e09a169171cb9832f41e538f875f88f09d0e6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

transfer-encoding: chunked
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 198 KB
97 KB 612ms
366ms Fetch
application/json 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 5691497741208210cab7d2062983cb2c053c362805ec9ef3903edd559704be35

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

transfer-encoding: chunked
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 347 KB
179 KB 915ms
668ms Fetch
application/json 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 608e64cf0fb0df504b2ed5e7fb346a164a0d94420bfe987c912e0ce83381e649

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

transfer-encoding: chunked
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H/1.1 200
OK 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 243 KB
121 KB 590ms
339ms Fetch
application/json 45.55.124.119
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 45.55.124.119 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: 929641d9f2e6af91543e82236e406182c8d67e9ed7b0383eeb21c3b784d5c266

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

transfer-encoding: chunked
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
311 B 340ms
113ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4a772e98efc8467b7f399847c085a015dc4549f085b151b72e17655bd980bb1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 400 auction Show response
elb.the-ozone-project.com/openrtb2/ 236 B
708 B 323ms
111ms Fetch
text/plain 172.64.153.66
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.66 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6589f704aea9fcfe5d5fb76ec2827b5aeaa1b91d8e541f0c35a2b3de58a57983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 9474722d183f4cac-PHL
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 236
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 6 KB
3 KB 417ms
152ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: f30c5be6f914847b3919cb02cd1bf4aee7664515ab14cad2f7c9f91add66219c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 206.66.99.134
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2389
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain
vary: Origin

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
244 B 355ms
69ms Fetch
application/json 34.193.13.168
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748505499473&to=600&aun=pw-160x600_atf&pubcid=1a585a80-4ecc-4eaa-8528-25a5242cea18&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=f0156484-2b8d-4df9-87da-0a0de923a617&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.13.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-13-168.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 355ms
71ms Fetch
application/json 34.193.13.168
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748505499474&to=600&aun=pw-160x600_btf&pubcid=1a585a80-4ecc-4eaa-8528-25a5242cea18&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=a095166c-1282-4bb1-808a-fe1167d8c785&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.13.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-13-168.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 356ms
72ms Fetch
application/json 34.193.13.168
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748505499474&to=600&aun=leaderboard_atf&pubcid=1a585a80-4ecc-4eaa-8528-25a5242cea18&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=92147062-0724-4f94-971f-b6ea8d048d2e&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.13.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-13-168.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 354ms
70ms Fetch
application/json 34.193.13.168
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1748505499474&to=600&aun=leaderboard_btf&pubcid=1a585a80-4ecc-4eaa-8528-25a5242cea18&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=816781b0-0e31-4410-8ac1-654e036ba307&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.13.168 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-13-168.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 85 B
621 B 326ms
65ms Fetch
application/json 3.167.112.106
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.112.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-112-106.iad55.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 3b43ae5196a644b8133da6f8608e0b98d92a0210f0aef7a55219d69003a5375b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 5b0b018dc5d72a42f205b24b17f4f56e.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 110
x-amz-cf-id: 92nDGI5hhytehBi-fWsA8VufkkmCp9wDQut1lkkdNX6nCO1fWBsmdg==
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
x-amz-cf-pop: IAD55-P8
server: istio-envoy
x-reason: maxmind anonymous
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
462 B 485ms
247ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.43.0&cb=1264464374&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:19 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 200 translator Show response
hbopenbid.pubmatic.com/ 84 KB
16 KB 390ms
114ms Fetch
application/json 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 519a7c8cebf39cb13bbe7f4d1e672428e36489b9bff24888a8c7ba3f07f8d73d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
content-encoding: gzip
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
server: nginx

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 349ms
55ms Fetch
application/json 34.206.91.202
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.43.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.206.91.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-206-91-202.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 75ms
74ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 29 May 2025 08:13:19 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 29 May 2025 07:58:19 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 328ms
61ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 328ms
62ms XHR
application/json 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H3 200 gk1g0hpg5epqxiz_qy24imfve Show response
faucetfoot.com/confirm/ 295 B
319 B 209ms
99ms Fetch
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/confirm/gk1g0hpg5epqxiz_qy24imfve

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/scripts/l5fne80l3kwl-prod.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

fe3bf02dc43790619e33e5c696755f60345c7f811a47fb27bc1411446a3c5579

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-chmc.gce-us-east1, 1.1 google
expires: Thu, 29 May 2025 07:58:18 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 AGSKWxUlAU3xvlsVaKhirP65H2vK_KrxAklFTGr01za34tH2Cd7Rie8oFli08eVEb1BLVunk8J4Ii8fSEi4Gi2OQjYCSb9EHYpPNubAWOAEFJpBGPVKAmzUltEsfdpg4fySFRrTEnNceeg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 108ms
106ms Script
application/javascript 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUlAU3xvlsVaKhirP65H2vK_KrxAklFTGr01za34tH2Cd7Rie8oFli08eVEb1BLVunk8J4Ii8fSEi4Gi2OQjYCSb9EHYpPNubAWOAEFJpBGPVKAmzUltEsfdpg4fySFRrTEnNceeg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NTA1NDk5LDYwMjAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJnUFJEME5GZXE1SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxc2Fkdi5yaWdhcHJlY2FzdC5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ee755482598d2e61ca61ac7c27014e05a3c0324dc4ac68a7263d18ac28652d33

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-AfatKw9RSC7cnEJjqk048w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmLw0JBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F4zcZbrFuBuEn7NmsXEJv53Wa1A2IhHo7Zyx8cZBN48enkdiYljaT8wvjk_LySosyk0pL8orTktNTi1KKy1KJ4IwMjUwNTI3M9A-P4AgMACIBFQw"
content-security-policy: script-src 'report-sample' 'nonce-AfatKw9RSC7cnEJjqk048w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 8C56 102 KB
28 KB 230ms
32ms Document
text/html 2607:f8b0:4004:c09::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

56b8de493133e66949fb4e7179fc6398806e734bb30cef739674fe9254f4c4b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1578
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 07:32:01 GMT
expires: Thu, 29 May 2025 08:22:01 GMT
last-modified: Mon, 19 May 2025 19:44:47 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 257ms
59ms Script
application/javascript 2600:9000:269f:b800:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:269f:b800:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 1975
x-cache: Hit from cloudfront
x-amz-cf-id: bscg7i4CDWHllwrpDIcXelwFbmJTtY1BAN7kkzEg74NUE9_aneJy3A==
date: Thu, 29 May 2025 07:25:25 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 fbdc01f132101cb05310363b09502a86.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: YUL62-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 214ms
40ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 909117
x-goog-stored-content-encoding: gzip
expires: Mon, 18 May 2026 19:26:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sun, 18 May 2025 19:26:22 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2Vwp-3nEK_zBFGYRtYnYwJI9zc5v8MFzKj_xYleJA6wjMT_bPDVEo1Yi9NpMelbDfuhHpLzlhRjY
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 553ms
371ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: e703e71ef260aaa0c701e8770115cd80

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 218ms
45ms Script
application/javascript 104.18.28.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.28.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 511604
cf-ray: 9474722dcc6817b5-EWR
expires: Sun, 01 Jun 2025 07:58:19 GMT
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 215ms
41ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 30 May 2025 07:58:19 GMT
access-control-allow-origin: *
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
460 B 242ms
74ms XHR
application/json 2606:ae80:1451:21::500
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:21::500 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 29 May 2025 08:28:19 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 212ms
59ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 3589
cross-origin-resource-policy: cross-origin
cf-ray: 9474722df8771016-EWR
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 29 May 2025 03:05:43 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 127 B
269 B 82ms
80ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3bb7d6193103e7fd684708b0825a4c7932bbc88272320f56c7d75bb8346bd5b5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 9474722e8f07447a-EWR
access-control-allow-origin: *
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 221ms
69ms Preflight
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 9474722dfeba447a-EWR
content-length: 0
content-type: text/plain
date: Thu, 29 May 2025 07:58:19 GMT
expires: Fri, 29 May 2026 07:58:19 GMT
server: cloudflare

GET
H2 200 pbs_sync Show response
sync.cootlogix.com/api/user/html/ Frame 55B3 4 KB
4 KB 195ms
45ms Document
text/html 147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: fa02593875b81d8f09415397dd6c0f108b70c577e8a0b4424da6e26a78caac82

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
content-length: 4089
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 AGSKWxUtGfBlyr77D0oz8T5IRvKJ_GNl4DcsCJS6iCaFSa06MUbP0rqiADw_ghCkGu8KGr_VZZhs1ing643HxL3Of3L_xWhZpnnRoXUbUOtGIy4dc2UA9yUTNRdhoD6buk4qwit7WCBapg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 93ms
93ms Script
application/javascript 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUtGfBlyr77D0oz8T5IRvKJ_GNl4DcsCJS6iCaFSa06MUbP0rqiADw_ghCkGu8KGr_VZZhs1ing643HxL3Of3L_xWhZpnnRoXUbUOtGIy4dc2UA9yUTNRdhoD6buk4qwit7WCBapg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NTA1NDk5LDcyMzAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiZ1BSRDBORmVxNUkiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXNhZHYucmlnYXByZWNhc3QuY29tIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88b2ef00db25c1ca5f21d1e1ed489171744ba23da53bd5a44fd9fbca80b4a672

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-w-S4bECi_EQU2YvmHIyy9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtHikmJw0ZBiWMy_i-nkrdtMF4G49eY51ulAbKhwidUZiO-vu8T6HIg_1F9m_QHERRJXWFuA-FPVDVaR6husSew3WUuAONTxJmssCKfdZE0F4l0bb7EeBuIm7dusXUBs5neb1Q6IhXg4Zi9_cJBN4MWtuZ-YlDSS8gvjk_PzSooyk0pL8ovSktNSi1OLylKL4o0MjEwNTI3M9QyM4wsMAP1vRsQ"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-w-S4bECi_EQU2YvmHIyy9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 174ms
79ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 07:58:19 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 202361
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1748505499839&did=did-0046&se=e30&duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.riga...
https://rp4.liadm.com/j?dtstmp=1748505499839&did=did-0046&se=e30&duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.rig...

13 B
370 B

193ms
37ms

Fetch
application/json

52.7.88.100
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1748505499839&did=did-0046&se=e30&duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.rigaprecast.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMxMzQ6OjEzNA%3D%3D
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.7.88.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-7-88-100.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: aa6cb6fe-dc3f-4145-a9d6-74bd66f87ca9
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1748505499839&did=did-0046&se=e30&duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsadv.rigaprecast.com%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMxMzQ6OjEzNA%3D%3D
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=44f25091-72f5-4666-b23b-1d65550b9b76&bid=1e2n4ou

70 B
440 B

79ms
37ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=44f25091-72f5-4666-b23b-1d65550b9b76&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=44f25091-72f5-4666-b23b-1d65550b9b76&bid=1e2n4ou
content-length: 191
date: Thu, 29 May 2025 07:58:20 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MmNHZzRjZHo0bGRkMHk5UUNKVFdkV0pxN3NmbGIwVkFPYzZKMndxU0VQWkE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MmNHZzRjZHo0bGRkMHk5UUNKVFdkV0pxN3NmbGIwVkFPYzZKMndxU0VQWkE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPI3YGdW6pC0Ix3RxOnielE&google_cver=1

70 B
440 B

43ms
43ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPI3YGdW6pC0Ix3RxOnielE&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPI3YGdW6pC0Ix3RxOnielE&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-nBZR5cxE2pUvefX1nz6tQLlzJhkOZb2rbas-~A&gdpr=0

70 B
440 B

76ms
30ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-nBZR5cxE2pUvefX1nz6tQLlzJhkOZb2rbas-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-nBZR5cxE2pUvefX1nz6tQLlzJhkOZb2rbas-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4351049939433950658&newuser=1&referrer_pid=m51mh00

70 B
440 B

50ms
49ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4351049939433950658&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4351049939433950658&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 07:58:27 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=703550309037702214&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

42ms
42ms

Image
image/gif

52.55.144.0
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=703550309037702214&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-55-144-0.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 29 May 2025 07:58:19 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=703550309037702214&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.134; 206.66.99.134; 1044.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 5d8e51d5-4062-4047-8643-817bddae10fa
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:19 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 528ms
237ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

dae15c027f8b0977bb3962da0d42083e316a59684af648a988ee9681a1f78a8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 157ms
34ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250528.1/main.80efcc48269da6666d6e.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame B46B 16 KB
6 KB 152ms
47ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

41446a7078f22662b9d265e40764760dd615b13d704c6cdd9983991c94cfaf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 07:58:19 GMT
server: Kestrel
server-processing-duration-in-ticks: 224840
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H3 200 setuid
prebid.intergient.com/ Frame 55B3 0
839 B 136ms
50ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=vidazoo&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=d66315b9-0592-531f-6664-32a708364572
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748505500&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=B%2F%2FvN0NEywyGWFA1emdmQq2xvLnaXSiHUMkQsX%2FaYYc%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748505500&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=B%2F%2FvN0NEywyGWFA1emdmQq2xvLnaXSiHUMkQsX%2FaYYc%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 9474722f1c6143fa-EWR
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://secure.adnxs.com/getuid?https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dappnexus%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=appnexus&userId=703550309037702214&gdpr=&gdpr_consent=&us_privacy=&gdpr=&gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHBxfFWNo5QruGsmwD&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

48ms
47ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHBxfFWNo5QruGsmwD&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHBxfFWNo5QruGsmwD&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gd...
https://image8.pubmatic.com/AdServer/ImgSync?p=159988&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmatics2s%26userId%3D%23PMUID%26gdpr%3D%26gd...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=N0UzNUU5N0UtREEzOS00QjkxLTg3NTgtM0VBRDEwRDhGM0M1&gdpr=-1&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=-1&gdpr_consent=&piggybackCookie=CAESEPUkc9IHSemuomQc-gIub_4&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

32ms
31ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=pubmaticut&userId=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 173
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_consent=&us...
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dgrid%26userId%3D%24%7BBSW_UUID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D?gdpr=&gdpr_conse...
https://sync.cootlogix.com/api/cookie?partnerId=grid&userId=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=&gdpr_consent=&us_privacy=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

35ms
31ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&us_privacy=&gdpr=&gdpr_consent=
https://sync.1rx.io/usersync2/rmpssp?sub=vidazoo&zcc=1&cb=1748505500079
https://ad.turn.com/r/cs?pid=45&id=RX-b9174154-30a1-4c57-98fa-adc8f253bed5-005&rndcb=5527006920
https://sync.1rx.io/usersync/turn/4351049939433950658?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-b9174154-30a1-4c57-98fa-adc8f253bed5-005?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dunruly%26userId%3DRX-b9174154-30a1-4c57-...
https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b9174154-30a1-4c57-98fa-adc8f253bed5-005

43 B
496 B

71ms
71ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b9174154-30a1-4c57-98fa-adc8f253bed5-005
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=unruly&userId=RX-b9174154-30a1-4c57-98fa-adc8f253bed5-005
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
date: Thu, 29 May 2025 07:58:20 GMT
etag: RXb917415430a14c5798faadc8f253bed5005
content-type: text/html

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dtriplelift%26userId%3D$UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=triplelift&userId=1825756856123598538412&gdpr=&gdpr_consent=&us_privacy=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZH_zDhuONZRriUqleg&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113

43 B
496 B

112ms
74ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Content-Length: 0
Date: Thu, 29 May 2025 07:58:19 GMT
Etag: c28134395f2ea113
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D&sovrn_retry=true
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113

43 B
496 B

70ms
69ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Content-Length: 0
Date: Thu, 29 May 2025 07:58:19 GMT
Etag: c28134395f2ea113
Server: Adtelligent

GET

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 55B3
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%26gdp...
https://image8.pubmatic.com/AdServer/ImgSync?p=160318&gdpr=&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dpubmaticut%26userId%3D%23PMUID%26gdpr%3D%26gdp...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=QTE5REIxM0EtMkE3Ri00MzQyLUE4MjktQzIxM0EzQjIwMjAy&gdpr=-1&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=-1&gdpr_consent=&piggybackCookie=CAESEPUkc9IHSemuomQc-gIub_4&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oZ2xOip_Q0KoKcITo7ICAg%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESELnch4fyXjabncj3cLWolkI&google_cver=1

0
0

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=TAEWcTBw&gdpr=&gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=sharthrough&userId=3eb629cb-ca18-4323-bb73-1be59c4f79ef
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113

43 B
496 B

122ms
31ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Content-Length: 0
Date: Thu, 29 May 2025 07:58:19 GMT
Etag: c28134395f2ea113
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://sync.inmobi.com/oRTB?&gdpr_consent=&gdpr=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dinmobi%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D%26userId%3D%7BID5UID%7D&gdpr_consent=&gdpr=&us...
https://sync.cootlogix.com/api/cookie?partnerId=inmobi&gdpr=&gdpr_consent=&us_privacy=&userId=ID5-5-3cf3588c-cc27-4db4-878a-febc6025b8c4
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113

43 B
496 B

67ms
31ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=c28134395f2ea113
Content-Length: 0
Date: Thu, 29 May 2025 07:58:19 GMT
Etag: c28134395f2ea113
Server: Adtelligent

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3442&_fw_gdpr=&_fw_gdpr_consent=
https://sync.cootlogix.com/api/cookie?partnerId=freewheel&userId=1ca060d188cb59f85fae4c24b53d888a&_fw_gdpr=&_fw_gdpr_consent=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZH_zDhuONZRriUqleg&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

44ms
44ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZH_zDhuONZRriUqleg&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

location: https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZH_zDhuONZRriUqleg&gdpr=&gdpr_consent=&us_privacy=
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
vary: Accept-Encoding
access-control-allow-headers: X-Requested-With, Content-Type

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 55B3
Redirect Chain

https://cs.media.net/cksync?cs=30&type=vdz&gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dmedianet%26userId%3D%3Cvsid%3E%26gdpr%3D%26gdpr_con...
https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3915071005045866000V10&gdpr=&gdpr_consent=&us_privacy=

43 B
496 B

44ms
43ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3915071005045866000V10&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://sync.cootlogix.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Location: https://sync.cootlogix.com/api/cookie?partnerId=medianet&userId=3915071005045866000V10&gdpr=&gdpr_consent=&us_privacy=
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 29 May 2025 07:58:20 GMT
x-mnet-hl2: E
Content-Length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: text/html
Server: Apache

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
704 B 63ms
44ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: d072ee386d80670cb50b3dd91192ee1f4a4f37eaa792c46d12432d5a7be0536f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 64ms
46ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 63ms
45ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 61ms
43ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 40ms
40ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 29 May 2025 08:13:19 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 29 May 2025 07:58:19 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame F552
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=vidazoo&endpoint=us-east
https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

269 B
379 B

190ms
74ms

Document
text/html

23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 29 May 2025 07:58:20 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
location: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
server: AkamaiGHost

GET
H2 200 cm Show response
u.openx.net/w/1.0/ Frame 8DAB 199 B
425 B 209ms
74ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?cc=1&id=4241c706-9fd2-4ae4-b2d7-c9f8d34e773c&ph=f4cc9fb1-057b-4e7a-b393-325ee9109574&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenx%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: de259eb7ba7a0e45575deb33946f1fbc695c97c33145ae4e49af0069d010868e

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 199
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.134

GET
H2

200

cm Show response
us-u.openx.net/w/1.0/ Frame DEC3
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_I...
https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOP...

946 B
1 KB

56ms
55ms

Document
text/html

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 83921b785fb73a925ffab9272dff5bb3d3cad834aa9e4d3f5bed2113147d90d5

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 946
content-type: text/html
date: Thu, 29 May 2025 07:58:19 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.134

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 29 May 2025 07:58:19 GMT
location: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.134

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame 74B0
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=12776
https://eus.rubiconproject.com/usync.html?p=12776

269 B
379 B

192ms
75ms

Document
text/html

23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=12776
Requested by: Host: sync.cootlogix.com
URL: https://sync.cootlogix.com/api/user/html/pbs_sync?gdpr=&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dvidazoo%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24%7BuserId%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://sync.cootlogix.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 29 May 2025 07:58:20 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
location: https://eus.rubiconproject.com/usync.html?p=12776
server: AkamaiGHost

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 52ms
51ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=3cbca6b8-78b4-4578-b4ac-f85aeefb3fe4&ccsid=d85b888f-06f3-4da1-8209-82f47d83117e
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 17 KB
5 KB 56ms
55ms Script
text/javascript 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: bb49a28501d03a18c34788c4f2ce63bb58c188deb99bb62b4698de3534456bad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
228 B 122ms
121ms Fetch
text/plain 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/plain;charset=utf-8
vary: Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 447ms
159ms Fetch
application/json 2001:41d0:701:1000::20f2
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::20f2 , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: e2f80d03ac13801dbe92a3b2c094d67164f3ff25cacf0afd6e1af55c1343bfd4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 601ms
257ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

ac7935f74d79ad8b54251985daeab3ea18b3b02c6de71370996b93e546772774

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 74ms
43ms Image
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=2f3d4619-370b-4b6e-894b-faa43d510af7&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qsadv.rigaprecast.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=98436d40-dd4f-4c5d-b376-b8eb3e07787d&ccuid=3cbca6b8-78b4-4578-b4ac-f85aeefb3fe4&sid=d85b888f-06f3-4da1-8209-82f47d83117e&nct=1748505500000&r=https%3A%2F%2Fqsadv.rigaprecast.com%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&devicefp=206.66.99.134%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=72ec59b2-8286-4813-acf1-1f7a1a007ba2&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 29 May 2025 07:58:20 GMT
content-length: 0

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 189ms
48ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10c0d08c9ddb0dece1c1a2499d1b9a6913d43283165ccbcfcbe0911273000af3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 198
cf-ray: 947472309a834350-EWR
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 29 May 2025 03:55:47 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
94 B 306ms
165ms Image
image/gif 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&halo_id=060ixefju6a6599969e6666666666666666uomowi0e0y66606m00000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747230a89fc4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
244 B 458ms
211ms Image
text/html 35.161.193.79
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001748505500-XDU5230V-7LUY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.161.193.79 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-161-193-79.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748505500-XDU5230V-7LUY&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748505500-XDU5230V-7LUY&adnxs_id=703550309037702214&gdpr=0

43 B
95 B

201ms
200ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748505500-XDU5230V-7LUY&adnxs_id=703550309037702214&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747230f90dc4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001748505500-XDU5230V-7LUY&adnxs_id=703550309037702214&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.134; 206.66.99.134; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: fe4287d7-062f-4013-911e-0c49c9c17cdc
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001748505500-XDU5230V-7LUY%26auid%3DAU...
https://ids.ad.gt/api/v1/openx?openx_id=24dc573a-1aa4-4e20-b043-e3a4814fa94d&id=AU1D-0100-001748505500-XDU5230V-7LUY&auid=AU1D-0100-001748505500-XDU5230V-7LUY

43 B
95 B

155ms
154ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=24dc573a-1aa4-4e20-b043-e3a4814fa94d&id=AU1D-0100-001748505500-XDU5230V-7LUY&auid=AU1D-0100-001748505500-XDU5230V-7LUY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 947472310938c4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=24dc573a-1aa4-4e20-b043-e3a4814fa94d&id=AU1D-0100-001748505500-XDU5230V-7LUY&auid=AU1D-0100-001748505500-XDU5230V-7LUY
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001748505500-XDU5230V-7LUY
https://ids.ad.gt/api/v1/pbm_match?pbm=7E35E97E-DA39-4B91-8758-3EAD10D8F3C5&id=AU1D-0100-001748505500-XDU5230V-7LUY

43 B
95 B

136ms
136ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=7E35E97E-DA39-4B91-8758-3EAD10D8F3C5&id=AU1D-0100-001748505500-XDU5230V-7LUY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 947472312956c4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=7E35E97E-DA39-4B91-8758-3EAD10D8F3C5&id=AU1D-0100-001748505500-XDU5230V-7LUY
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:20 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001748505500-XDU5230V-7LUY&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&rub=MB93124U-23-51UO&gdpr=0

43 B
95 B

127ms
126ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&rub=MB93124U-23-51UO&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 9474723179ccc4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&rub=MB93124U-23-51UO&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 207e6e3bf58d030312efc0c602ea89b7
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001748505500-XDU5230V-7LUY&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=44f25091-72f5-4666-b23b-1d65550b9b76&id=AU1D-0100-001748505500-XDU5230V-7LUY

43 B
95 B

254ms
167ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=44f25091-72f5-4666-b23b-1d65550b9b76&id=AU1D-0100-001748505500-XDU5230V-7LUY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747230b8b4c4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=44f25091-72f5-4666-b23b-1d65550b9b76&id=AU1D-0100-001748505500-XDU5230V-7LUY
content-length: 259
date: Thu, 29 May 2025 07:58:20 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001748505500-XDU5230V-7LUY&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748505500...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001748505500-XDU5230V-7LUY&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001748...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=10508570-7bf7-42e3-84a5-a50c87964a48%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=44f25091-72f5-4666-b23b-1d65550b9b76&ttd_puid=10508570-7bf7-42e3-84a5-a50c87964a48%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&tapad_id=10508570-7bf7-42e3-84a5-a50c87964a48

43 B
95 B

128ms
128ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&tapad_id=10508570-7bf7-42e3-84a5-a50c87964a48
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747232cb7fc4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&tapad_id=10508570-7bf7-42e3-84a5-a50c87964a48
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
server: Jetty(11.0.25)

GET
H2 200 pixel
cm.g.doubleclick.net/ 170 B
243 B 55ms
53ms Image
image/png 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001748505500-XDU5230V-7LUY

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001748505500-XDU5230V-7LUY
https://ids.ad.gt/api/v1/amo_match?turn_id=4351049939433950658&id=AU1D-0100-001748505500-XDU5230V-7LUY

43 B
170 B

219ms
130ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=4351049939433950658&id=AU1D-0100-001748505500-XDU5230V-7LUY
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747230a8a1c4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=4351049939433950658&id=AU1D-0100-001748505500-XDU5230V-7LUY
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 07:58:19 GMT

GET
H2

200

son_match
ids.ad.gt/api/v1/
Redirect Chain

https://sync.go.sonobi.com/us?https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&uid=[UID]&gdpr=0
https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&uid=6eddb509-09a8-40c8-a541-4562d2939f74&gdpr=0

43 B
95 B

137ms
136ms

Image
image/gif

2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&uid=6eddb509-09a8-40c8-a541-4562d2939f74&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94747231da51c4fb-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-cache, no-store, private
location: https://ids.ad.gt/api/v1/son_match?id=AU1D-0100-001748505500-XDU5230V-7LUY&uid=6eddb509-09a8-40c8-a541-4562d2939f74&gdpr=0
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 29 May 2025 07:58:20 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-6-72
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001748505500-XDU5230V-7LUY
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODUwNTUwMC1YRFU1MjMwVi03TFVZ

170 B
188 B

53ms
52ms

Image
image/png

142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODUwNTUwMC1YRFU1MjMwVi03TFVZ

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 94747230b8b5c4fb-EWR
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0ODUwNTUwMC1YRFU1MjMwVi03TFVZ
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2

200

sid Show response
mug.criteo.com/ Frame B46B
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=xkXopHxGRWVlbytqQkFLRHowTVpHRjNMRVU2UUhRbE1seDJTc2t4aTBrenR0Q01NcnhocU5PNFN0b21GTlI1UDBqNkN3M1RITHM0bVNTYWhCY1NJVU1oRTduYlBXa2VwY3pFWG5SSGZXVlk0U0tzT1Z4ZXkyekl0UHRBQn...

430 B
1001 B

184ms
79ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=xkXopHxGRWVlbytqQkFLRHowTVpHRjNMRVU2UUhRbE1seDJTc2t4aTBrenR0Q01NcnhocU5PNFN0b21GTlI1UDBqNkN3M1RITHM0bVNTYWhCY1NJVU1oRTduYlBXa2VwY3pFWG5SSGZXVlk0U0tzT1Z4ZXkyekl0UHRBQnJNdU94ZHJxa1hFVVcwZWt5c1UrNHlkdWlmYlg3U0kwSXNrNnQrQ1Fjd2RkcmV3ZWdpdW00N290amJkcnpUQnBCSFJ5a2NXcGRuMmNlc3FGQm1meE0rd211WURJOHJFOWEzNktzZ0NsZjJScUEwdnhoeTZYZUpQNzlOWC9TTjB3c1U2SVlOeHpMZFNNNXhoRzVVM1RwVXFUR1lsQm1LV2Q2L2xwekhCSzVVc3JxL2pEV21ITT18&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

152465cbf2c3118e8d7fcd6be027fe83fff3c0a1a92f3f96d6e029b35d80ec54

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1046832
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Thu, 29 May 2025 07:58:19 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=xkXopHxGRWVlbytqQkFLRHowTVpHRjNMRVU2UUhRbE1seDJTc2t4aTBrenR0Q01NcnhocU5PNFN0b21GTlI1UDBqNkN3M1RITHM0bVNTYWhCY1NJVU1oRTduYlBXa2VwY3pFWG5SSGZXVlk0U0tzT1Z4ZXkyekl0UHRBQnJNdU94ZHJxa1hFVVcwZWt5c1UrNHlkdWlmYlg3U0kwSXNrNnQrQ1Fjd2RkcmV3ZWdpdW00N290amJkcnpUQnBCSFJ5a2NXcGRuMmNlc3FGQm1meE0rd211WURJOHJFOWEzNktzZ0NsZjJScUEwdnhoeTZYZUpQNzlOWC9TTjB3c1U2SVlOeHpMZFNNNXhoRzVVM1RwVXFUR1lsQm1LV2Q2L2xwekhCSzVVc3JxL2pEV21ITT18&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 304383
expires: 0
content-length: 0
date: Thu, 29 May 2025 07:58:19 GMT
server: Kestrel

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 243ms
136ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: e6cdafbeb4b5811a1afeab342ade1c0cde2b9cd3aea8501522b9576deb9ca247

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json
x-cloud-trace-context: 129077bd661c164f7bc525df41153d27
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame DEC3
Redirect Chain

https://sync.cootlogix.com/api/cookie?partnerId=openxut&userId=46f12978-9387-4dbf-893d-e833619c461b&gdpr=&gdpr_consent=&us_privacy=
https://ap.lijit.com/pixel?gdpr=&gdpr_consent=&redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dsovrn%26userId%3D%24UID%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
https://sync.cootlogix.com/api/cookie?partnerId=sovrn&userId=Kva-ALZHn8p8ZHlnSDG8GWAn&gdpr=&gdpr_consent=&us_privacy=
https://sync.adtelligent.com/csync?redir=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Daudienceconnect%26userId%3D%7Buid%7D
https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f6da72c795d5c310

43 B
496 B

29ms
29ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f6da72c795d5c310
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Location: https://sync.cootlogix.com/api/cookie?partnerId=audienceconnect&userId=f6da72c795d5c310
Content-Length: 0
Date: Thu, 29 May 2025 07:58:19 GMT
Etag: f6da72c795d5c310
Server: Adtelligent

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DEC3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrFRqlKDWzc-tTJoSv-ii0&google_cver=1

43 B
61 B

39ms
38ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrFRqlKDWzc-tTJoSv-ii0&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENrFRqlKDWzc-tTJoSv-ii0&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame DEC3 170 B
243 B 123ms
55ms Image
image/png 142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MjFmMzlkOTUtNWE1Zi0yZjc4LWY2NTgtYWQ0ZDVjZDJhODI5

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DEC3
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=0d9c4e5f-9328-71dc-e3b8-f7f496306649&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072971&val=44f25091-72f5-4666-b23b-1d65550b9b76&ttd_puid=0d9c4e5f-9328-71dc-e3b8-f7f496306649&gdpr=0&gdpr_consent=

43 B
62 B

54ms
54ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072971&val=44f25091-72f5-4666-b23b-1d65550b9b76&ttd_puid=0d9c4e5f-9328-71dc-e3b8-f7f496306649&gdpr=0&gdpr_consent=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
vary: Accept

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072971&val=44f25091-72f5-4666-b23b-1d65550b9b76&ttd_puid=0d9c4e5f-9328-71dc-e3b8-f7f496306649&gdpr=0&gdpr_consent=
content-length: 335
date: Thu, 29 May 2025 07:58:20 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DEC3
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/995b281b-0384-e395-d26f-e1016967ab00?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-KXhHFE9E2p9wwrLbu4PnaYtYSxkW6_pKbTM-~A

43 B
61 B

43ms
43ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-KXhHFE9E2p9wwrLbu4PnaYtYSxkW6_pKbTM-~A
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:19 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-KXhHFE9E2p9wwrLbu4PnaYtYSxkW6_pKbTM-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame DEC3
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDgTnAAUNm5HkAAL

85 B
170 B

41ms
40ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDgTnAAUNm5HkAAL
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748505500.401152,VS0,VE0
age: 139
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740032-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 91

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aDgTnAAUNm5HkAAL
x-timer: S1748505500.333089,VS0,VE9
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
x-served-by: cache-ewr-kewr1740032-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame DEC3
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=4351049939433950658&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

46ms
45ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4351049939433950658&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=fba3d144-1026-4d31-a758-943b9545e305&gdpr=&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fsync.cootlogix.com%2Fapi%2Fcookie%3FpartnerId%3Dopenxut%26userId%3D%7BOPENX_ID%7D%26gdpr%3D%26gdpr_consent%3D%26us_privacy%3D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://us-u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=4351049939433950658&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 07:58:19 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 325 KB
114 KB 49ms
49ms Script
application/javascript 2607:f8b0:4004:c21::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1125140106ddcf605508a5df4e0ec0d9b2b416a45f847db31a5b21d993b7575d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 29 May 2025 07:58:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 116687
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
112 B 145ms
143ms XHR
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 947472310c631016-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 300ms
141ms Script
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 947472321d2688c3-EWR
cf-cache-status: DYNAMIC
date: Thu, 29 May 2025 07:58:20 GMT
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 367ms
222ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 94747231fe6eb89f-EWR
date: Thu, 29 May 2025 07:58:20 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST match
seg.ad.gt/api/v2/ 0
0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame F552 44 KB
11 KB 97ms
95ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cd494c9c78669d6da3b5fde935f303839299f87a7baa9b1d11bf67a9fc5474c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=vidazoo&endpoint=us-east

Response headers

cache-control: max-age=57235
content-encoding: gzip
expires: Thu, 29 May 2025 23:52:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11452
date: Thu, 29 May 2025 07:58:20 GMT
last-modified: Wed, 28 May 2025 23:52:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame 74B0 44 KB
0 90ms
90ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=12776
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cd494c9c78669d6da3b5fde935f303839299f87a7baa9b1d11bf67a9fc5474c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?p=12776

Response headers

cache-control: max-age=57235
content-encoding: gzip
expires: Thu, 29 May 2025 23:52:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11452
date: Thu, 29 May 2025 07:58:20 GMT
last-modified: Wed, 28 May 2025 23:52:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 128ms
126ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

d22d06b72b95c8294c9bd5998b3873cd6788d1898b4253cb6bc59d65388a73b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json
vary: Origin

GET
H3 200 ad Show response
fundingchoicesmessages.google.com/f/AGSKWxUKuVuEyNE6nuvIkW0Bkfg5NUMkyYjmgeIROmR8vOk-w2d_4tqFt5M1Qbb2GCB_4e_NtBUA0vdVaXlLDuJ58hz76Nl78tFfANzSyBuSiYAoMgTmL5gFhbnR4lGA24efag17ocMak71xIXsKngQwIZ_gA2mVv... 54 B
109 B 54ms
53ms Script
application/javascript 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxUKuVuEyNE6nuvIkW0Bkfg5NUMkyYjmgeIROmR8vOk-w2d_4tqFt5M1Qbb2GCB_4e_NtBUA0vdVaXlLDuJ58hz76Nl78tFfANzSyBuSiYAoMgTmL5gFhbnR4lGA24efag17ocMak71xIXsKngQwIZ_gA2mVv-jlLPPoiz9zXZ5BFHR_1_zhKppU9hUZ/_/ad/load..lazyload-ad./public/ad?.cgi?ad=_adbg2.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3129867628ad0ba506c6b753f81f9fc09e40cc36206875b58ba032aa37430be

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-BJOp17ujuJ2uBZ5bcvVkGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytHikmLw15BiWMy_i6n15jnW6UBsqHCJ1RmI76-7xPociD_UX2b9AcRFEldYW4D4U9UNVpHqG6xJ7DdZS4A41PEmaywIp91kTQXiXRtvsR4G4ibt26xdQGzmd5vVDoiFeDjmLH9wkE3gx-l3fUxKGkn5hfHJ-XklRZlJpSX5RWnJaanFqUVlqUXxRgZGpgamRuZ6BsbxBQYA0L5Brg"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-BJOp17ujuJ2uBZ5bcvVkGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 156 KB
52 KB 172ms
55ms Script
text/javascript 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.gPRD0NFeq5I.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMwSttEQ-lwSD-pAd0KocKiEcV5gcA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8615adbabda34ff80b3503069287d13704e111924b69880985294352d16d8657

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 10633295063388056800
x-content-type-options: nosniff
expires: Thu, 29 May 2025 07:58:20 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 53259
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 190ms
112ms XHR
text/html 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-CF4YYo6LAkF6k2WkTuPIrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1JBi-FB_mfUHEJv53Wa1A2IhHo45yx8cZBOY0PjiPJOSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLXMzCPLzAAAJQtJ3A"
content-security-policy: script-src 'report-sample' 'nonce-CF4YYo6LAkF6k2WkTuPIrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 141ms
117ms XHR
text/html 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-VAB9yocSqqIHEXfmKDagXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1pBi-FB_mfUHEJv53Wa1A2IhHo45yx8cZBP4cXfaZSYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSuZ2AeX2AAALfLJ-g"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-VAB9yocSqqIHEXfmKDagXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 cm Show response
u.openx.net/w/1.0/ Frame 4916 953 B
976 B 38ms
38ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: feeae0cb2968064b3ab5c5ee4331c19f94c1ca7f9421f775a0fe2f306bd11b24

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 953
content-type: text/html
date: Thu, 29 May 2025 07:58:20 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.134

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 113ms
112ms XHR
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

cd4cc24597b6030ff8716c257e58b269c6802c99b5a5701403f00a12d4b78c16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json
vary: Origin

GET
H3 200 setuid
prebid.intergient.com/ Frame 4916 0
909 B 52ms
50ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=openx&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=3442c190-2ab7-4235-8834-37e1176ba4c4
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748505500&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=B%2F%2FvN0NEywyGWFA1emdmQq2xvLnaXSiHUMkQsX%2FaYYc%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html
vary: Origin
priority: u=2,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748505500&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=B%2F%2FvN0NEywyGWFA1emdmQq2xvLnaXSiHUMkQsX%2FaYYc%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 94747233aeb943fa-EWR
server: cloudflare

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 4916
Redirect Chain

https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
https://us-u.openx.net/w/1.0/sd?id=537072399&val=703550309037702214

43 B
61 B

36ms
36ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072399&val=703550309037702214
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-store, no-cache, private
location: https://us-u.openx.net/w/1.0/sd?id=537072399&val=703550309037702214
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.134; 206.66.99.134; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 7743c3c8-5a83-4df3-b6f2-94c8bd0ae995
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame 4916
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D%7BOPENX_ID%7D
https://id.rlcdn.com/464246.gif?partner_uid=585a3139-5e6f-47bc-bcc1-7707afab0791
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=585a3139-5e6f-47bc-bcc1-7707afab0791

42 B
318 B

68ms
66ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=585a3139-5e6f-47bc-bcc1-7707afab0791
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=585a3139-5e6f-47bc-bcc1-7707afab0791
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2 200 receive
pixel.tapad.com/idsync/ex/ Frame 4916 95 B
765 B 143ms
58ms Image
image/png 34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=0be23da3-c82f-4c5b-a959-6f22a5bca745

Requested by

Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.25) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

strict-transport-security: max-age=31536000
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 95
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/png
server: Jetty(11.0.25)

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 4916
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=4&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072977&val=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&gdpr=0&gdpr_consent=

43 B
61 B

57ms
56ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072977&val=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&gdpr=0&gdpr_consent=
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0,no-cache,no-store
location: https://us-u.openx.net/w/1.0/sd?id=537072977&val=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&gdpr=0&gdpr_consent=
pragma: no-cache
via: 1.1 google
expires: Tue, 11 Oct 1977 12:34:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
content-length: 0
date: Thu, 29 May 2025 07:58:20 GMT
server: A

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 4916
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://us-u.openx.net/w/1.0/sd?id=537073028&val=${ADELPHIC_CUID}
https://us-u.openx.net/w/1.0/sd?id=537073028&val=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b

43 B
61 B

38ms
38ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073028&val=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Accept

Redirect headers

X-CI-RTID: ecf7ab25-fd00-4160-9a4f-fadf7c1711d9
Location: https://us-u.openx.net/w/1.0/sd?id=537073028&val=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b
Content-Length: 112
Date: Thu, 29 May 2025 07:58:20 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

dds
rtb.openx.net/sync/ Frame 4916
Redirect Chain

https://rtb.openx.net/sync/dds
https://cm.g.doubleclick.net/pixel?google_nid=open&google_hm=0srEYzquyPIFzLtDRSlc8w==&ox_sc=1&ox_init=1
https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1

43 B
107 B

61ms
59ms

Image
image/gif

35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
Requested by: Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=&gdpr_consent=&r=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dopenx%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%7BOPENX_ID%7D
Protocol: H2
Server: 35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://u.openx.net/

Response headers

cache-control: private, max-age=0, no-cache, must-revalidate
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:20 GMT
content-type: image/gif
vary: Origin

Redirect headers

cache-control: no-cache, must-revalidate
location: https://rtb.openx.net/sync/dds?ox_sc=1&ox_init=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 249
date: Thu, 29 May 2025 07:58:20 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

POST
H3 200 gl8lpzono6p00fp_xtd7mgzx6
faucetfoot.com/ 2 B
25 B 131ms
46ms Ping
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/gl8lpzono6p00fp_xtd7mgzx6

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/scripts/l5fne80l3kwl-prod.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1797731198 /

Resource Hash

4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-chmc.gce-us-east1, 1.1 google
expires: Thu, 29 May 2025 07:58:19 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1797731198
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H3 204 AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 55ms
54ms XHR
text/html 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-k8U5SMJPPi8dkCkWs-nb8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmLw1pBi-FB_mfUHEJv53Wa1A2IhHo45yx8cZBPYMOd7E7OSS1J-YXxyfl5Jal6JbmJKsS6IXZSZVFqSX4TCTi0DqcjJT0_PzEuPNzIwMjUwNTLXMzCPLzAAAJURJ3A"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-k8U5SMJPPi8dkCkWs-nb8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 110ms
108ms XHR
text/html 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUDISeBTC0trveQbZzzZPIQm9c4znUVUJnG1EH_hROsX4JzFNQD_AdaNXXm-S4FL-HpgO8cGb1g5Xic1jYQXw0dIm0bqMUcRNY0OSva6uOxGy4spKUaJAuVFwE0rRqK5vghRKjfFg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-cjNoXSZ2mGpusYOuBtRM0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmII1pBi-FB_mfUHEJv53Wa1A2IhHo45yx8cZBPY8eLVPGYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSuZ2AeX2AAALTMJ9s"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-cjNoXSZ2mGpusYOuBtRM0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxV6vY5Mm34-lBNrF4qGkk7R8Z1oVDmHCQlJGkv_Bybqg6gPZ4A6NixxwEzgJ096vDrSsSUtN4A7vjPWuaWNBV0HQ9KSlWk9B6KRs8cnl8fbtgRjFSqAQuGesdwQlVnhuTA-xV6tqA== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 90ms
90ms Script
application/javascript 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxV6vY5Mm34-lBNrF4qGkk7R8Z1oVDmHCQlJGkv_Bybqg6gPZ4A6NixxwEzgJ096vDrSsSUtN4A7vjPWuaWNBV0HQ9KSlWk9B6KRs8cnl8fbtgRjFSqAQuGesdwQlVnhuTA-xV6tqA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ4NTA1NTAwLDc4NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJnUFJEME5GZXE1SSJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxc2Fkdi5yaWdhcHJlY2FzdC5jb20iXSxbMjksImZhbHNlIl1dXQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

170ce691ef4b07a966278d2c46351594e8eda6ff5d0fbf48ca36d9652b1f0bf9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-8oFOTCWAMow_e3c9RoJT2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjKtDikmII1JBiOHnrNtNFIG69eY51OhAbKlxidQbi--susT4H4g_1l1l_AHGRxBXWFiD-VHWDVaT6BmsS-03WEiAOdbzJGgvCaTdZU4F4zcZbrFuBuEn7NmsXEJv53Wa1A2IhHo45yx8cZBOYsORGB7OSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRqYGpkbmegXF8gQEA6vhEiA"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-8oFOTCWAMow_e3c9RoJT2w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2

200

9.gif
id5-sync.com/c/483/1245/0/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*j5b2e4kMd4xSUH5Mz31zu5IDJTBtxqLrVDmc7nNWgvEeysBQTsIeOgkeEO6HECIX&gdpr_consent=undefined&gdpr=false
https://ib.adnxs.com/getuid?https://id5-sync.com/c/483/2/7/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/2/7/2.gif?puid=703550309037702214&gdpr=0&gdpr_consent=
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-958bP6-5leTzsFV53r2iJKDrKdtlbPLimlL3xfVM6A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F6%2F3.gif%3Fpuid%3...
https://ice.360yield.com/ul_cb/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-958bP6-5leTzsFV53r2iJKDrKdtlbPLimlL3xfVM6A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F483%2F124%2F6%2F3.gif%3F...
https://id5-sync.com/cq/483/124/6/3.gif?puid=c7ffd94a-1a5a-4313-bb57-b51f3143eefd&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F441%2F5%2F4.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/483/441/5/4.gif?puid=u_ce0c6cc6-18dc-4d48-9d62-52354f10cb26&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=44f25091-72f5-4666-b23b-1d65550b9b76&ttl=%%TTL%%
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F3%2F6.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/3/6.gif?puid=10508570-7bf7-42e3-84a5-a50c87964a48&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F2%2F7.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/2/7.gif?puid=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
https://id5-sync.com/k/155.gif?puid=AAIFN07QcCcAABssWUpJ2g&id5AccountNum=155&numCascadesAllowed=9
https://ce.lijit.com/merge?pid=27&3pid=44f25091-72f5-4666-b23b-1d65550b9b76&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F0%2F9.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/0/9.gif?puid=Kva-ALZH_zDhuONZRriUqleg&gdpr=0&gdpr_consent=

43 B
1 KB

114ms
112ms

Image
image/gif

162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to Show image

Full URL

https://id5-sync.com/c/483/1245/0/9.gif?puid=Kva-ALZH_zDhuONZRriUqleg&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://id5-sync.com/c/483/1245/0/9.gif?puid=Kva-ALZH_zDhuONZRriUqleg&gdpr=0&gdpr_consent=
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:23 GMT
vary: Accept-Encoding

POST
H3 204 AGSKWxWHEK_hWx5o3U912qFXl4_GZSEVWPpOoU5IaFbrAmaLoUseK2HdjwI71hU2i7kOfNJnSHOa2hZSNjohACEXi0lLI_oYZ1Tk17nIlElawa0YO4-9nUJtTGm4-9eeCbQaxX3UPlGd_Q== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 51ms
49ms XHR
text/html 2607:f8b0:4004:c08::8b
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWHEK_hWx5o3U912qFXl4_GZSEVWPpOoU5IaFbrAmaLoUseK2HdjwI71hU2i7kOfNJnSHOa2hZSNjohACEXi0lLI_oYZ1Tk17nIlElawa0YO4-9nUJtTGm4-9eeCbQaxX3UPlGd_Q==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::8b Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-h8J6y9KEjm2mYLSWydCVeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:20 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjktDikmJw0ZBi-FB_mfUHEJv53Wa1A2IhHo45yx8cZBN4MHPnRmYll6T8wvjk_LyS1LwS3cSUYl0QuygzqbQkvwiFnVoGUpGTn56emZceb2RgZGpgamSuZ2AeX2AAAJr1J4c"
content-security-policy: script-src 'report-sample' 'nonce-h8J6y9KEjm2mYLSWydCVeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame F552 7 B
1 KB 151ms
35ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 7
content-type: application/json; charset=UTF-8

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 74B0 7 B
1 KB 180ms
29ms XHR
application/json 69.173.146.5
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.146.5 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
content-length: 7
content-type: application/json; charset=UTF-8

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 384C 1 KB
2 KB 29ms
28ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: d9e0604c1c5b5b3fc3c044b0e03415f8a37648ca56a0dfda283f9a8a9a5d553e

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1235
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 07:58:21 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

xuid
eb2.3lift.com/ Frame 384C
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=44f25091-72f5-4666-b23b-1d65550b9b76&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

33ms
33ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=44f25091-72f5-4666-b23b-1d65550b9b76&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=44f25091-72f5-4666-b23b-1d65550b9b76&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 29 May 2025 07:58:21 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 384C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH1uujbornvaaYdT45N0bVE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
474 B

1022ms
1022ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH1uujbornvaaYdT45N0bVE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEH1uujbornvaaYdT45N0bVE&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 384C
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgyNTc1Njg1NjEyMzU5ODUzODQxMg%3D%3D

170 B
188 B

72ms
71ms

Image
image/png

142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgyNTc1Njg1NjEyMzU5ODUzODQxMg%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID

Protocol

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgyNTc1Njg1NjEyMzU5ODUzODQxMg%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:21 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 384C
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTgyNTc1Njg1NjEyMzU5ODUzODQxMg%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

62ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 384C 0
247 B 231ms
110ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1825756856123598538412&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 2433231B622A468585214D4614B7CB5D Ref B: PHL30EDGE0107 Ref C: 2025-05-29T07:58:21Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2QalLIfIVblt9jvVc5A==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT

GET

/
p.adsymptotic.com/d/px/ Frame 384C
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=1825756856123598538412
https://he.lijit.com/merge?pid=8105&event_type=email&lc_md5=9f37e120704c87672b8066b824e2d4ec&lc_sha1=1110a64959fa3192677c404175ccc2418b37e1a4&lc_sha256=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b...
https://pippio.com/api/sync?pid=710524&_=1&it=4&iv=9f37e120704c87672b8066b824e2d4ec&it=4&iv=1110a64959fa3192677c404175ccc2418b37e1a4&it=4&iv=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b11f088c1dfc...
https://p.adsymptotic.com/d/px/?_pid=16257&_psign=5a9f251662be469b9732c38b03f11952&_redirect=https%3A%2F%2Fpippio.com%2Fapi%2Fsync%3Fpid%3D710202%26it%3D1%26iv%3D%24%7BUUID%7D&_rand=07184424

0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame 384C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/1825756856123598538412?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-9RzHQWlE2oQF4oM16v4e4Bk2lP3hQdvJF.fY1mQPaA--~A&dongle=0883

37 B
474 B

83ms
82ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-9RzHQWlE2oQF4oM16v4e4Bk2lP3hQdvJF.fY1mQPaA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-9RzHQWlE2oQF4oM16v4e4Bk2lP3hQdvJF.fY1mQPaA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 384C 42 B
699 B 206ms
65ms Image
image/gif 2620:1ec:33::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=1825756856123598538412&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "902348561bc4db1:0"
x-msedge-ref: Ref A: FFEDB949EF1D4CFA8927D6646FA7A600 Ref B: PHL30EDGE0119 Ref C: 2025-05-29T07:58:21Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
last-modified: Tue, 13 May 2025 15:26:02 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 384C
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=2504e129d92e07b1&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQANj-AiYbkI7gI161pAAQEBAQEBAQCWGg2eCQEBAQEBAQEB&expiration=1748591901&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

50ms
47ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQANj-AiYbkI7gI161pAAQEBAQEBAQCWGg2eCQEBAQEBAQEB&expiration=1748591901&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQANj-AiYbkI7gI161pAAQEBAQEBAQCWGg2eCQEBAQEBAQEB&expiration=1748591901&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 384C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-8a674937-72e6-5440-5ffa-c93e31e85fc9$ip$206.66.99.134&dongle=4430

37 B
474 B

33ms
29ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-8a674937-72e6-5440-5ffa-c93e31e85fc9$ip$206.66.99.134&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-8a674937-72e6-5440-5ffa-c93e31e85fc9$ip$206.66.99.134&dongle=4430
Content-Length: 139
Date: Thu, 29 May 2025 07:58:21 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 setuid
prebid.intergient.com/ Frame 384C 0
1004 B 48ms
47ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=1825756856123598538412
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1748505501&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=3s4OilSh8iI%2BcwGAabHn9xLK6I%2BuJ1JwVZ54xWcFVj8%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 29 May 2025 07:58:21 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1748505501&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=3s4OilSh8iI%2BcwGAabHn9xLK6I%2BuJ1JwVZ54xWcFVj8%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 947472364fdb43fa-EWR
server: cloudflare

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame F552
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=vidazoo&khaos=MB93124U-23-51UO
https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MB93124U-23-51UO

43 B
496 B

40ms
35ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MB93124U-23-51UO
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.cootlogix.com/api/cookie?partnerId=rubicon&userId=MB93124U-23-51UO
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
content-length: 0
Content-Type: text/html

GET
H2

200

cookie
sync.cootlogix.com/api/ Frame 74B0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=12776&khaos=MB93124U-23-51UO
https://usr.undertone.com/userPixel/sync?partner=rubicon&uid=MB93124U-23-51UO
https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MB93124U-23-51UO

43 B
496 B

43ms
43ms

Image
image/avif

147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to Show image

Full URL: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MB93124U-23-51UO
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"
content-length: 43
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/avif
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization

Redirect headers

via: 1.1 f084ab450a6c71ebe23f8602cefd27ae.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
location: https://sync.cootlogix.com/api/cookie?partnerId=rubiconut&userId=MB93124U-23-51UO
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
x-amz-cf-pop: YUL62-P1
x-amz-cf-id: j3lTybWUfIKDn0Rawninia13b5qzk-nzig6rxbkEohUguaZEr_CtVA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F552
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUI5MzEyNFUtMjMtNTFVTw==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOQXbT85L5dsSIBtJkkNxlk&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUI5MzEyNFUtMjMtNTFVTw==&google_push=

170 B
188 B

54ms
52ms

Image
image/png

142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUI5MzEyNFUtMjMtNTFVTw==&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUI5MzEyNFUtMjMtNTFVTw==&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: eea754ae2ea80a3b4eb2fcf35349058a
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F552
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/nIiWztA2TessGjbVp6xtZsn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ceuXWFBE2oIfuxaOE_TTRxl8nhFt0H6k74oDKw--~A

42 B
1 KB

174ms
46ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ceuXWFBE2oIfuxaOE_TTRxl8nhFt0H6k74oDKw--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ceuXWFBE2oIfuxaOE_TTRxl8nhFt0H6k74oDKw--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

usersync
vid-io-iad.springserve.com/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/token?pid=52948&gdpr=1&gdpr_consent=&us_privacy=&rk=iad
https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB93124U-23-51UO&gdpr=1

43 B
206 B

258ms
104ms

Image
image/gif

52.86.205.90
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB93124U-23-51UO&gdpr=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.86.205.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-86-205-90.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-allow-origin: *
content-length: 43
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
server: nginx
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://vid-io-iad.springserve.com/usersync?aid=1000025&uuid=MB93124U-23-51UO&gdpr=1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 382e2818ca015d35b02cd449aa60881d
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

dcm
aax-eu.amazon-adsystem.com/s/ Frame F552
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t

43 B
855 B

192ms
192ms

Image
image/gif

67.220.224.150
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

67.220.224.150 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 76B0ZP3ZSE7JF5DHJYQS
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 07:58:21 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: X868A1X1E9A5WBKQJZXZ
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 07:58:21 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame F552
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

43 B
855 B

102ms
47ms

Image
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: ZQC127ZDRXXCXR6HE8P6
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 07:58:21 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Location: https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 9XRQ0XDAY7GQ1BY1RSSD
Content-Length: 0
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 07:58:21 GMT
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MB93124U-23-51UO&ex=d-rubiconproject.com&status=ok

43 B
720 B

53ms
48ms

Image
image/gif

98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MB93124U-23-51UO&ex=d-rubiconproject.com&status=ok

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: 9WM50X452AJ3TKHH4BD7
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 29 May 2025 07:58:21 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MB93124U-23-51UO&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F552
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHVxehh482DdIyaeGvyH-iQ&google_cver=1

42 B
1 KB

192ms
47ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHVxehh482DdIyaeGvyH-iQ&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEHVxehh482DdIyaeGvyH-iQ&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F552
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTNmNjI4YWIyNDA3YmE2MTI1YTAwMGM2YjAzZjZkNWE5ODFjYzYzZA

170 B
188 B

45ms
43ms

Image
image/png

142.251.163.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTNmNjI4YWIyNDA3YmE2MTI1YTAwMGM2YjAzZjZkNWE5ODFjYzYzZA

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

142.251.163.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OTNmNjI4YWIyNDA3YmE2MTI1YTAwMGM2YjAzZjZkNWE5ODFjYzYzZA
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 413d5c0bc8511bb08cd28279cbcfceeb
Pragma: no-cache
content-length: 0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame F552
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB93124U-23-51UO

0
141 B

108ms
103ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB93124U-23-51UO
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 3B15E80001F1464C957C408018D822A1 Ref B: PHL30EDGE0107 Ref C: 2025-05-29T07:58:21Z
x-li-fabric: prod-ltx1
x-li-uuid: AAY2QalMe8ISrkqF8hSapg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MB93124U-23-51UO
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 207e6e3bf58d030312efc0c602ea89b7
Pragma: no-cache
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F552
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

153ms
30ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 78008fe701b681dce86a72fc23cacc40
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 29 May 2025 07:58:21 GMT
server: Kestrel

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F552
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp&_bee_ppp=1
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIFN07QcCcAABssWUpJ2g&expires=30

42 B
1 KB

30ms
29ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIFN07QcCcAABssWUpJ2g&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: d67ad46d58ddbab9fb03c088eabaaff8
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAIFN07QcCcAABssWUpJ2g&expires=30
Content-Length: 0
Date: Thu, 29 May 2025 07:58:21 GMT
Server: gunicorn
Connection: keep-alive

GET
H2

200

merge
ce.lijit.com/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=MB93124U-23-51UO

43 B
501 B

208ms
71ms

Image
image/gif

52.54.72.131
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=MB93124U-23-51UO
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.54.72.131 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-72-131.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ce.lijit.com/merge?pid=80&3pid=MB93124U-23-51UO
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0b388c490ecfef74be7d13328a4f3ac3
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
capi.connatix.com/us/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=MB93124U-23-51UO&pId=11&gdpr=&gdpr_consent=&us_privacy=

0
329 B

153ms
58ms

Image
text/plain

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://capi.connatix.com/us/pixel?puid=MB93124U-23-51UO&pId=11&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 104.18.41.104 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 947472398c2b3ee0-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
content-type: text/plain;charset=UTF-8
vary: Accept-Encoding
server: cloudflare
priority: u=3,i
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://capi.connatix.com/us/pixel?puid=MB93124U-23-51UO&pId=11&gdpr=&gdpr_consent=&us_privacy=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 20e8391fc78a9019eb67dba4b22f0ac2
content-length: 0
Content-Type: text/html

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB93124U-23-51UO

43 B
1 KB

65ms
65ms

Image
image/gif

68.67.179.87
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB93124U-23-51UO

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 206.66.99.134; 206.66.99.134; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 57b30f58-1821-47d3-ad84-401559fd5472
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=MB93124U-23-51UO
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 0
Content-Type: text/html

GET
H2

204

magnite
sync.a-mo.net/setuid/ Frame F552
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://sync.a-mo.net/setuid/magnite?uid=MB93124U-23-51UO

0
725 B

280ms
94ms

Image
text/plain

125.253.89.175
SS-ASH

General

Check archive.org

Download Go to Show image

Full URL: https://sync.a-mo.net/setuid/magnite?uid=MB93124U-23-51UO
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 125.253.89.175 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: max-age=0, private, must-revalidate
date: Thu, 29 May 2025 07:58:21 GMT
x-envoy-upstream-service-time: 5
vary: accept-encoding, Accept-Encoding
server: envoy

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://sync.a-mo.net/setuid/magnite?uid=MB93124U-23-51UO
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: e1bddfc34a927e97bda010c0d8a62b62
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame F552
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=${ADELPHIC_CUID}&expires=30
https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&expires=30

42 B
1 KB

64ms
64ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&expires=30
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

X-CI-RTID: bd452e15-85f6-467d-9842-443d21cdf662
Location: https://pixel.rubiconproject.com/tap.php?v=17149&nid=2861&put=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&expires=30
Content-Length: 144
Date: Thu, 29 May 2025 07:58:21 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 30 KB
3 KB 399ms
398ms Fetch
text/plain 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=5026321482269302&correlator=1283828604029781&eid=31090594%2C31092253%2C95353384%2C83321073&output=ldjh&gdfp_req=1&vrg=202505200101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1748505501446&lmt=1748505501&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsadv.rigaprecast.com%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=ElYKDGlkNS1zeW5jLmNvbRJESUQ1KjRUYVI0dWVzRUJVODhCblZvZDBVSXZ5alFxa0Rac1Z5T3BuN2R4MzI1V2dleWtnYVpRYUFnTHJXMEhOanREbkhYARI0CgpwdWJjaWQub3JnEiQxYTU4NWE4MC00ZWNjLTRlYWEtODUyOC0yNWE1MjQyY2VhMThYARInChJydWJpY29ucHJvamVjdC5jb20SD0xWMlRJVVo3LVQtTEtQRlgBEjcKDWJpZHN3aXRjaC5uZXQSJGQ3OTdjYTNkLWJjYzAtNDU0NS04Y2JjLTk3ZWZiODMwMWQ5NFgBEj8KHGxpdmVpbnRlbnQuaW5kZXhleGNoYW5nZS5jb20SHVplTTkxOUhNNmRnQUFDVktBQnlCdGdBQSYzNjQ0WAESNgoMcHVibWF0aWMuY29tEiRCMjJFOUJEMi0xRDQxLTREN0QtODgyMC1EQjM3Qzc3NDJENDFYARIdCg5lc3AuY3JpdGVvLmNvbRjdr7LY8TJIAFICCGQSGAoJeWFob28uY29tGJeystjxMkgAUgIIbxLuAQoIcnRiaG91c2US2AF1Qm10Ymd2SERMV2JZaTVpeDVYa3pzYXZoQkJLbWFleFA3YWVsNm5KNHE4a01vWmFqcllHQ05JOFlQR0RIYmNaYlBaZHZvL3p3VjV5OHdQdHNLL1AzZmNrK21USmhiWDQ0TUs2OEtxVjVZblFyVnZ4WWI2WW5GRytvbDZnR2lUQ1RhTkZIajBOTHdYeUZINnNBWXhIbFVaOVhaUVFsZTlNbzhMNS9ydlZFclhSKyt0dVduMEZGamdzNTduYkxWZFlyMmlCSEVtMitiVGthOGkwTmNaSXBBPT0YiLay2PEySAASFAoFb3BlbngY8bGy2PEySABSAghvEhsKDDMzYWNyb3NzLmNvbRjdr7LY8TJIAFICCGQSMwoJb3BlbngubmV0EiRkNDkwOTkyZS1iM2ZhLTQyZTAtOGVjMy1kYzYyMmZjOGViZGFYARKHAQoObGl2ZWludGVudC5jb20SczE2LUhiT0FZek1MaDcxTGVjNWFhNFVGVVZFVVdZTmdZN3huMTZ5clhqclBabUlSQ0ZsL1N2UlFJWnM4dG9tL1AxMnFEaEVUcXlDc0plc0hnZFRpNjRiWXVYVHRiS1VMRExpaXNPV0t0YURVSmZJaWF3PT1YARIzChlsaXZlaW50ZW50LnRyaXBsZWxpZnQuY29tEhQ3NzI3Mzc1NzI0OTM4MjE3ODgzNFgB&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1748505498200&idt=948&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dtrue%26custom_path%3D160x600%26lld_id%3De3779e90671240d3978017ffe86c7f5a05499309%26price_floor%3Dna%26amznbid%3D1o5u328%26amznp%3D1fwo5xc%26amzniid%3DJCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.12%26hb_adid_s2s_ix%3D170e62b49e6afe238%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_s2s_pubmat%3Dbanner%26hb_size_s2s_pubmatic%3D160x600%26hb_pb_s2s_pubmatic%3D0.12%26hb_adid_s2s_pubmatic%3D1717a61c824057be%26hb_bidder_s2s_pubmat%3Ds2s_pubmatic%26hb_format_ix%3Dbanner%26hb_size_ix%3D160x600%26hb_pb_ix%3D0.13%26hb_adid_ix%3D14630ebda8e0415a%26hb_bidder_ix%3Dix%26hb_cache_host_s2s_vi%3Dprebid.adnxs.com%26hb_format_s2s_vidazo%3Dbanner%26hb_size_s2s_vidazoo%3D160x600%26hb_pb_s2s_vidazoo%3D0.13%26hb_adid_s2s_vidazoo%3D177d14209a79a752%26hb_bidder_s2s_vidazo%3Ds2s_vidazoo%26hb_format_pubmatic%3Dbanner%26hb_size_pubmatic%3D160x600%26hb_pb_pubmatic%3D0.35%26hb_adid_pubmatic%3D133cd252e7bf86cc%26hb_bidder_pubmatic%3Dpubmatic%26hb_format_vidazoo%3Dbanner%26hb_size_vidazoo%3D160x600%26hb_pb_vidazoo%3D0.63%26hb_adid_vidazoo%3D1561c5cfcc6171208%26hb_bidder_vidazoo%3Dvidazoo%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.63%26hb_adid%3D1561c5cfcc6171208%26hb_bidder%3Dvidazoo%26bid_type%3Dclient&cust_params=pf_src%3Dml%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqsadv.rigaprecast.com%252F%26tyche_code%3DV.20250528.1%26pageos_code%3DV.20250528.1%26config_id%3D1024872_74068_primary_config%26hour%3D21%26day%3DWednesday%26referrer_domain%3Dqsadv.rigaprecast.com%26OS%3DLinux%2520null%26browser%3DChrome%2520137%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26refresh_count%3D0%26tyche_version%3DV.20250528.1%26ab_test%3Dna_A%26ad_clicker%3Dfalse%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=9189&tan=c29909a5-b224-45d2-acc9-5f545c15a300&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2ffed8c50ef90803f43d8b5c23de419958515cfe7e16a01414263a02f40de39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: 4726941490
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138237858944
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 3117
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
2ef3d7f1ee529f04df4fa30f274fda12.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 7C9F 7 KB
3 KB 208ms
52ms Document
text/html 2607:f8b0:4004:c21::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://2ef3d7f1ee529f04df4fa30f274fda12.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c21::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 07:58:21 GMT
expires: Thu, 29 May 2025 07:58:21 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4B9F 0
0 69ms
69ms Fetch
image/gif 2607:f8b0:4004:c09::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscbVvnsEMrK47ZdgMQ0gmmm-hu3U61NSORp4rD-ABiL4_60A9RAaqjg6Ln_mBNZ-dqvfkXO1d4eASIRHaf3ixSa_8J-Xzk9chHGe2eVcTV4txWGoFmI2DSEKzqA7K2AYTXH336y1z37_HnILn3gjZ8uE-yVdXPGfm4j1VEmCiqPEhLU59VjTPNT5ShL4YoYkZr5VRQLeBlQTxfD_Q-PBq4xiBCBNkHnnu0vWDAvbx0F3UIM3wnLpIOgC5c5MA56a24QoOc8JtTUrL4MJ7jYMmjVJR9iCStwyH3Avx_KrNxc7LoOePANVvIjZpTio2LXXXfITl2R3xdY-FnmDH26JCVo9fZEkcmbhXIvECrCvBDIsM8VQ6aynAu_g1sTZSSelx03DVenbIF-at_TQRLEhuak0SMEpWYhIn_j8m1wCtf15FBx6kxIZ7L1o9wDxj46csT3yQ7SWlEVJp2kzET-8iU1o4jiL-HNjFOECdiO0fR-k05i_198AC4QfqXQ8gqzyyEpMMxTNalEniwZx3Tx9Iz6GTQh05GLGd22T7Gruhl9qCrrid_dPUQPGbiVSOg9BmmPc-oj0VrjVxFi63NIXqkMQyU4rs&sai=AMfl-YT_3cwO5_NUinkvOtTTlhnBChoOVF7s_USSjeYm4h2thfafVp2pZauuofq8iRPVbk_cOl1z-v3UGBKU13ISQAjwg9hPJcQiCOqsBb7E03ZjWqg0b5ji8RAAsRsn&sig=Cg0ArKJSzOuVkxt9oj_PEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c09::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4B9F 221 KB
68 KB 47ms
46ms Script
text/javascript 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db9772412ddfb6a667eaedb6ee473ab3d9a855633fae513f3ee343dfc6de5580

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12739314704981603380
age: 2465
x-content-type-options: nosniff
expires: Thu, 29 May 2025 08:17:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 29 May 2025 07:17:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69733
x-xss-protection: 0
server: cafe

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 5C38 16 KB
6 KB 34ms
34ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

41446a7078f22662b9d265e40764760dd615b13d704c6cdd9983991c94cfaf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 29 May 2025 07:58:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 744527
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 8E07 3 KB
2 KB 158ms
46ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 1158
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 9474723bdb6e43d9-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 29 May 2025 07:58:22 GMT
expires: Thu, 29 May 2025 11:58:22 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame A7DB 0
0 29ms
29ms Document
text/plain 147.182.222.40
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=665db4754b2ec067196b8f78&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 147.182.222.40 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 29 May 2025 07:58:21 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame E8FB 269 B
379 B 36ms
36ms Document
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 29 May 2025 07:58:21 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame AC74 20 KB
7 KB 31ms
30ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=25370
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 29 May 2025 07:58:21 GMT
expires: Thu, 29 May 2025 15:01:11 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 71C6 764 B
1004 B 61ms
34ms Document
text/html 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d5a809099cf2604358b7b3b902136fcbdd673d98e7eabd4ee0e0cfd46dd76512

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 764
content-type: text/html
date: Thu, 29 May 2025 07:58:21 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.134

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame D759 52 KB
17 KB 135ms
34ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 85948
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 29 May 2025 07:58:22 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 471976, 128288
X-Served-By: cache-lga21993-LGA, cache-ewr-kewr1740077-EWR
X-Timer: S1748505502.052963,VS0,VE0

GET
H2 200 sync Show response
eb2.3lift.com/ Frame A340 1 KB
2 KB 36ms
34ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 40cfc95f685ec11f5c4574957466ff17dd9190588b316a47b3c88b54fe0f1638

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 07:58:21 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 36ms
31ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=m6ma5F9RWmFhYVNLT3dDNWNpTTZHSTlJSXpxZHAlMkZHTEF1YWRYeHFJcTNGbkR6SGtvdlpYdyUyQjZQOHpLamxxdjdRcEFkc2d6UzVrMk5KRlJRTms5VmhxbEtPdWdGUiUyQnBsTVI4bFhrZkF4Q0xUVWFuaWxhbHJ3RmJjZFAlMkIxZ3BKV3BKYWElMkZHYlNmaWRZWjJCYmdvcjBQcDJmVVF3JTNEJTNE&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 07:58:21 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 281688
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 255ms
253ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-44-219-29-134.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:22 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
661 B 38ms
37ms Fetch
application/javascript 54.210.31.80
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.210.31.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-210-31-80.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: 312fb110f81f62ee4223b5cb17f019813a9c9b704cff595e7862436b6386b992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 41ms
35ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0&tp=n7lIkAsB6xrdVaggBbwOvs3A4Cf57U2XZWZiXGn3j18%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 81b2f9e43964a5f88a4664ce40a3c9b53bb38f034ffbd68e8c65cb9fa1cd0e7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1656
date: Thu, 29 May 2025 07:58:21 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 517 B
0 4ms
4ms Fetch
text/plain 100.29.97.158
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jwdgs5mr9j1hnb70p273pmjq&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.29.97.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-29-97-158.compute-1.amazonaws.com
Software: /
Resource Hash: c72319f4e9833a24f39a18b994fc11302b6e5ce9e8959f8e8efd94b124e0c925

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 523e5d09634f8ffb
request-time: 3
access-control-allow-credentials: true
expires: Fri, 30 May 2025 07:58:19 GMT
access-control-allow-origin: https://paint.toys
content-length: 517
date: Thu, 29 May 2025 07:58:19 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=m6ma5F9RWmFhYVNLT3dDNWNpTTZHSTlJSXpxZHAlMkZHTEF1YWRYeHFJcTNGbkR6SGtvdlpYdyUyQjZQOHpLamxxdjd...
https://mug.criteo.com/sid?cpp=VbmvNHxVditFVDZMU0xqL0xMVXV0VitRMkx5QnRjaDNEeEZFako4QndQemY1Qmp0bjZQekdrSTNSeVFPOHlQcTF5eWFnNlViWjZjZTBHdUdybGxNVUMzc3JtbXovY3M2K3JmTFhtN1p2M0pHVlhIRmJ3Ly9lUXBFTHNlcH...

432 B
1 KB

39ms
30ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=VbmvNHxVditFVDZMU0xqL0xMVXV0VitRMkx5QnRjaDNEeEZFako4QndQemY1Qmp0bjZQekdrSTNSeVFPOHlQcTF5eWFnNlViWjZjZTBHdUdybGxNVUMzc3JtbXovY3M2K3JmTFhtN1p2M0pHVlhIRmJ3Ly9lUXBFTHNlcHlSU3FCdXkrSGMzcmZZZ3Z6WDBCeVU5K1FaRlNENVR2MXVieVp6bGNKZEpWUDViMXZ2dzQvT1RSU1IybVV4YWIzcHFXc01YUDgyWFl4ejNRbUUyVmhOSHBqRzFzRGFmRTd6SUY4bDNnTjJDeXRVVVBwa1RrODR5ZGsrdlphZlFKbGkrajFqNmtYMHVKd2RGS1EwZzU1bVNtT1N2cEJtSWh6enRuZURabVVTY3pLVCsxS05ORjdVSzRiOGVsZTVSajZWdWJnYnYzL0doK0hJekx0Z3FadGJLL3BmajZ3OWc9PXw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

bd38c324f60bf018c48ec1e0f7b38b52faf5982596a324c7fd66aebe2d07d764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 673568
expires: 0
access-control-allow-origin: null
date: Thu, 29 May 2025 07:58:21 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=VbmvNHxVditFVDZMU0xqL0xMVXV0VitRMkx5QnRjaDNEeEZFako4QndQemY1Qmp0bjZQekdrSTNSeVFPOHlQcTF5eWFnNlViWjZjZTBHdUdybGxNVUMzc3JtbXovY3M2K3JmTFhtN1p2M0pHVlhIRmJ3Ly9lUXBFTHNlcHlSU3FCdXkrSGMzcmZZZ3Z6WDBCeVU5K1FaRlNENVR2MXVieVp6bGNKZEpWUDViMXZ2dzQvT1RSU1IybVV4YWIzcHFXc01YUDgyWFl4ejNRbUUyVmhOSHBqRzFzRGFmRTd6SUY4bDNnTjJDeXRVVVBwa1RrODR5ZGsrdlphZlFKbGkrajFqNmtYMHVKd2RGS1EwZzU1bVNtT1N2cEJtSWh6enRuZURabVVTY3pLVCsxS05ORjdVSzRiOGVsZTVSajZWdWJnYnYzL0doK0hJekx0Z3FadGJLL3BmajZ3OWc9PXw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 290345
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 29 May 2025 07:58:21 GMT
server: Kestrel

GET
H2

200

ibs:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76

42 B
716 B

36ms
33ms

Image
image/gif

44.219.29.134
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

44.219.29.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v076-0b34a9a27.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: d9nIaJUnTJI=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=44f25091-72f5-4666-b23b-1d65550b9b76
content-length: 189
date: Thu, 29 May 2025 07:58:22 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=themediagrid&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=44f25091-72f5-4666-b23b-1d65550b9b76&expires=30&ssp=themediagrid&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}

43 B
103 B

52ms
51ms

Image
image/gif

35.211.202.130
GOOGLE-2

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=93&user_id=44f25091-72f5-4666-b23b-1d65550b9b76&expires=30&ssp=themediagrid&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/sync?dsp_id=93&user_id=44f25091-72f5-4666-b23b-1d65550b9b76&expires=30&ssp=themediagrid&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
content-length: 343
date: Thu, 29 May 2025 07:58:22 GMT
server: Kestrel

GET
H2 200 ad-impression-gpt
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 36ms
33ms Image
text/plain 18.212.140.196
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/ad-impression-gpt?engttl=60&engcount=0&engid=2f3d4619-370b-4b6e-894b-faa43d510af7&prevPvid=98436d40-dd4f-4c5d-b376-b8eb3e07787d&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qsadv.rigaprecast.com&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=98436d40-dd4f-4c5d-b376-b8eb3e07787d&ccuid=3cbca6b8-78b4-4578-b4ac-f85aeefb3fe4&sid=d85b888f-06f3-4da1-8209-82f47d83117e&nct=1748505501000&slotName=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&divId=pw-160x600_atf&size=160%2C600&sourceAgnosticLineItemId=4726941490&sourceAgnosticCreativeId=138237858944&lineItemId=4726941490&creativeId=138237858944&campaignId=2343956110&advertiserId=51353355&isBackfill=false&scriptId=paint.toys&parentId=5bb3e20859
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.212.140.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-212-140-196.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 29 May 2025 07:58:21 GMT
content-length: 0

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame E8FB 44 KB
0 3ms
3ms Script
text/html 23.45.149.111
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.149.111 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-149-111.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: cd494c9c78669d6da3b5fde935f303839299f87a7baa9b1d11bf67a9fc5474c5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=57235
content-encoding: gzip
expires: Thu, 29 May 2025 23:52:15 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11452
date: Thu, 29 May 2025 07:58:20 GMT
last-modified: Wed, 28 May 2025 23:52:15 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=7255&xuid=AAIFN07QcCcAABssWUpJ2g&dongle=bzwx&gdpr=0

37 B
475 B

1035ms
1030ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AAIFN07QcCcAABssWUpJ2g&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:23 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AAIFN07QcCcAABssWUpJ2g&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Thu, 29 May 2025 07:58:22 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame A340 43 B
168 B 39ms
38ms Image
image/gif 3.209.150.229
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.150.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-150-229.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 29 May 2025 07:58:22 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame A340 43 B
168 B 56ms
36ms Image
image/gif 3.209.150.229
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.209.150.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-209-150-229.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 29 May 2025 07:58:22 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&dongle=d54f&gdpr=0&gdpr_consent=

37 B
475 B

1016ms
1012ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:23 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: cda488af-036a-42df-8aa6-db4ae689a904
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Thu, 29 May 2025 07:58:22 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3Df213...
https://eb2.3lift.com/xuid?mid=3646&xuid=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
474 B

82ms
75ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
server: Jetty(11.0.25)

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=1825756856123598538412&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=triplelift
https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=triplelift
https://x.bidswitch.net/sync?dsp_id=70&user_id=5559281989490181237&ssp=triplelift
https://eb2.3lift.com/xuid?mid=2409&xuid=398828df-7dab-4804-8c60-4d8563199ba4&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
474 B

61ms
60ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=398828df-7dab-4804-8c60-4d8563199ba4&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //eb2.3lift.com/xuid?mid=2409&xuid=398828df-7dab-4804-8c60-4d8563199ba4&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:22 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=4351049939433950658&dongle=d407&gdpr=0&gdpr_consent=

37 B
474 B

48ms
44ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=4351049939433950658&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=4351049939433950658&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 07:58:21 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame A340 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=799ce55b-6835-445b-ada7-340bb4c3f859&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=799ce55b-6835-445b-ada7-340bb4c3f859&gdpr=0

37 B
474 B

38ms
38ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=799ce55b-6835-445b-ada7-340bb4c3f859&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=799ce55b-6835-445b-ada7-340bb4c3f859&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Thu, 29 May 2025 07:58:22 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame A340
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=E58D64572E3F418F8BAC95AA0255C0EF&dongle=yf3

37 B
474 B

31ms
31ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=E58D64572E3F418F8BAC95AA0255C0EF&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=E58D64572E3F418F8BAC95AA0255C0EF&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 28 May 2025 07:58:22 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 29 May 2025 07:58:22 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 71C6
Redirect Chain

https://b1sync.zemanta.com/usersync/openx?puid=26513419-78a0-405e-b48b-6b36b520b832&cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__
https://b1sync.outbrain.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&puid=26513419-78a0-405e-b48b-6b36b520b832&s=2
https://b1sync.zemanta.com/usersync/openx?cb=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D560843120%26val%3D__ZUID__&obuid=7050185a-a947-4f1d-98fe-29d6f92bdad4&puid=26513419-78a0-405e-b48b-6b...
https://us-u.openx.net/w/1.0/sd?id=560843120&val=7050185a-a947-4f1d-98fe-29d6f92bdad4

43 B
61 B

51ms
47ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=560843120&val=7050185a-a947-4f1d-98fe-29d6f92bdad4
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=560843120&val=7050185a-a947-4f1d-98fe-29d6f92bdad4
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 112
date: Thu, 29 May 2025 07:58:22 GMT
content-type: text/html; charset=utf-8

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 71C6
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=268
https://us-u.openx.net/w/1.0/sd?id=537082476&val=imdJN3LmVEBf-sk-Mehfyc5CY4Y&gdpr=&gdpr_consent=

43 B
61 B

52ms
51ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537082476&val=imdJN3LmVEBf-sk-Mehfyc5CY4Y&gdpr=&gdpr_consent=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537082476&val=imdJN3LmVEBf-sk-Mehfyc5CY4Y&gdpr=&gdpr_consent=
Content-Length: 131
Date: Thu, 29 May 2025 07:58:22 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 71C6
Redirect Chain

https://idpix.media6degrees.com/orbserv/hbpix?pixId=856286&pcv=125&ptid=23&tpuv=00&tpu=a131dbd5-8bb0-54ea-1491-bc07b3fd268b
https://us-u.openx.net/w/1.0/sd?id=537072960&val=027vvdisy1lrl

43 B
61 B

106ms
105ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072960&val=027vvdisy1lrl
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache
location: https://us-u.openx.net/w/1.0/sd?id=537072960&val=027vvdisy1lrl
cf-cache-status: DYNAMIC
pragma: no-cache
cf-ray: 9474723d6ee832c6-PHL
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
server: cloudflare

GET
H2 200 709996.gif
id.rlcdn.com/ Frame 71C6 42 B
306 B 65ms
60ms Image
image/gif 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://id.rlcdn.com/709996.gif
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 71C6
Redirect Chain

https://x.bidswitch.net/sync?ssp=openx
https://rtb.adstanding.com/ssp/bidswitch/cookie?bidswitch_ssp_id=openx&bidswitch_custom_parameter=398828df-7dab-4804-8c60-4d8563199ba4
https://x.bidswitch.net/sync?dsp_id=317&user_id=bb87cd0071520940e1fba0a3f06ce67d&expires=30&ssp=openx&bsw_param=398828df-7dab-4804-8c60-4d8563199ba4
https://us-u.openx.net/w/1.0/sd?id=537072968&val=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=&gdpr_consent=&us_privacy=

43 B
61 B

107ms
107ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072968&val=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.134
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 29 May 2025 07:58:21 GMT
content-type: image/gif
vary: Accept

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //us-u.openx.net/w/1.0/sd?id=537072968&val=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=&gdpr_consent=&us_privacy=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:22 GMT

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 71C6 43 B
651 B 235ms
106ms Image
image/gif 3.161.213.67
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314908&puid=111eae21-dce4-4a4d-89fa-7b7e16f6f46f
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.161.213.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-161-213-67.yul62.r.cloudfront.net
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-methods: GET, OPTIONS
via: 1.1 dc2de227a66d49eadfba1450eb6faa90.cloudfront.net (CloudFront)
expires: 0
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 43
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif
x-amz-cf-pop: YUL62-P1
server: AAWebServer
x-amz-cf-id: XUs2LXIE8YhA6PkKV13yjysQwXSu1kjRi2OuvIh1ZsTAyn60CRXFBA==
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B9F 0
0 122ms
120ms Fetch
image/gif 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B9F 0
0 111ms
110ms Fetch
image/gif 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H/1.1 200 admi Show response
aax-us-east.amazon-adsystem.com/e/dtb/ Frame 7CB9 7 KB
4 KB 155ms
61ms Document
text/html 209.54.177.234
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&rnd=1732910100841748505501909&pp=1o5u328&p=1fwo5xc&crid=336949_160x600

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

209.54.177.234 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

8bfb71ad2ced507b18fe9ef65d6b88e501f9f7831ae94a551edf61c8f68ee683

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-store, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3343
Content-Type: text/html;charset=UTF-8
Date: Thu, 29 May 2025 07:58:22 GMT
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
x-amz-rid: B650PXHCNFD6ZB8HYJWV

GET
H2 200 csm_othersv6.js Show response
c.amazon-adsystem.com/bao-csm/direct/ Frame 4B9F 58 KB
18 KB 36ms
31ms Script
application/javascript 3.171.86.171
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/direct/csm_othersv6.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.171.86.171 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-171-86-171.iad89.r.cloudfront.net
Software: Server /
Resource Hash: 94a26e328e233d2c4b23f966f0836d1974b8b1db6ede373bbf9d9e97f478239b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
etag: 196984c43b1ab892e77abe088cd8e908
x-amz-version-id: mpGnYQBVfsk73au.QV3YsCJVAUE12jVB
age: 63888
x-cache: Hit from cloudfront
x-amz-cf-id: 0ReYrmClWM-CZ4McYuc8qLBshYjQFqGK4o1rB6S6OtlaCUx1s4J7VQ==
date: Wed, 28 May 2025 14:13:34 GMT
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=86400
via: 1.1 a035f6df76b0fcf3f3f167c837fad7ee.cloudfront.net (CloudFront)
accept-ranges: bytes
x-amz-rid: 1F3K66TX64KXDHP52J0J
x-amz-cf-pop: IAD89-P3
server: Server
x-amz-server-side-encryption: AES256

GET
H2

200

sid Show response
mug.criteo.com/ Frame 5C38
Redirect Chain

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=n5rAG3w1S09mTUdhdG1xbWxGbXpsOHF6L1ZNY1dlaEM0d09oQ0ZMdkZ1Q1VrZnQxNkIxdHRJampNeVBHK1NrN1h4RTZlaU9oU3VnRlJPMEg3YUxtWUpWaCtGRWg0SXE2T0JjWUdKZkpjc0tRSzU2d3N1TXZ2bU5EY0tDai...

1 KB
2 KB

40ms
39ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=n5rAG3w1S09mTUdhdG1xbWxGbXpsOHF6L1ZNY1dlaEM0d09oQ0ZMdkZ1Q1VrZnQxNkIxdHRJampNeVBHK1NrN1h4RTZlaU9oU3VnRlJPMEg3YUxtWUpWaCtGRWg0SXE2T0JjWUdKZkpjc0tRSzU2d3N1TXZ2bU5EY0tDai9ZSUNrYTc0eVN3Vk0xQ0hCRTdBVnlIb3dlY2Z2blllTGtXMGhjNjlRZmFwamlMVmRRR0t2NUJhQTJoZ0hodFRPaEkzZ3Yyb2xUMXJwaDYzK0Q2SXZ3MzZIRko1T3hhOFRhN1NpWVpKek9YYjYvOUdUQlh6L3U1bHlCVTM2YU5EZzZiaUNINWU4UkM4dklMTzFTam5JbnU1azJhMUZKNlYyQVFyRkhYeldhQ05WZXNGMmFiWWJVQ3FQSGR6eUJGbDBjT3NTbHU3V3w&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ab0dd980251e18a30721f21ff54b7c78d2459360c98038d3936f2d37461797f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1038096
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Thu, 29 May 2025 07:58:21 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=n5rAG3w1S09mTUdhdG1xbWxGbXpsOHF6L1ZNY1dlaEM0d09oQ0ZMdkZ1Q1VrZnQxNkIxdHRJampNeVBHK1NrN1h4RTZlaU9oU3VnRlJPMEg3YUxtWUpWaCtGRWg0SXE2T0JjWUdKZkpjc0tRSzU2d3N1TXZ2bU5EY0tDai9ZSUNrYTc0eVN3Vk0xQ0hCRTdBVnlIb3dlY2Z2blllTGtXMGhjNjlRZmFwamlMVmRRR0t2NUJhQTJoZ0hodFRPaEkzZ3Yyb2xUMXJwaDYzK0Q2SXZ3MzZIRko1T3hhOFRhN1NpWVpKek9YYjYvOUdUQlh6L3U1bHlCVTM2YU5EZzZiaUNINWU4UkM4dklMTzFTam5JbnU1azJhMUZKNlYyQVFyRkhYeldhQ05WZXNGMmFiWWJVQ3FQSGR6eUJGbDBjT3NTbHU3V3w&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 336962
expires: 0
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
server: Kestrel

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 39ms
37ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 29 May 2025 07:58:21 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 198153
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 4B9F 214 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 18cce10cd30e767d73c1840f9cb697678d270f7e40e7d006134210912f9019af

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4B9F 0
0 62ms
61ms Fetch
image/gif 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame E012
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=184674&gdpr=&gdpr_consent=&us_privacy=&gpp=&gppsid=&cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%2...
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_conse...

2 KB
902 B

106ms
101ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ff88f2dfd8ac9edaa4be2428bb14073f9234bc4ff7ec98aec5f2bd562cde485

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9474723dd9194321-EWR
content-encoding: br
content-type: text/html
date: Thu, 29 May 2025 07:58:22 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IF4MAPHyY6HfDGO%2Fh5UyZ8M4nrx9gdgkoDrfYLknPdBhqhexMHSNl5RVzUyl54jSGesX%2FI6Ak5fl9YOtiOD%2Bv%2BwSzxHQoXL7B11p03otlNViu5RzeAlpXIxeX6kxRHHm6ez2jLmoBluJfw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 9474723d28af4321-EWR
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RZOEHzvutgh61mXVSsaUwTBjTcwd8L4mjSeDToKcbo403M8gZcQUdsujbmz42zkebsJJDBYH3GZMtta%2FEyMJ8ENCO0YuHpblfjdUYfSKqZWGFrUigtO4ew0jj0PeH8f5ebS9yCWNX2i5GQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame AC74 5 KB
6 KB 158ms
40ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=69591246&p=158326&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 2a19b6e0280a17b06bb28bce2d827f431a21caed53f728e377ae5c6b007a0d0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:21 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame D759 0
792 B 36ms
35ms Script
text/html 68.67.179.87
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.87 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 206.66.99.134; 206.66.99.134; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: f26afa95-4572-4e8e-b1c3-8b16f55fb871
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 132ms
132ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

b6757256bed7664fc688d37b82c6708674581d0b4fb969d92549f4a5b4248c50

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 29 May 2025 07:58:22 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=aDu78F8zeXc3dmY2QVgzUURIcHBiUDM0eDJDY28xUTJ1QU1XNTA3SWpkUk4lMkZraFklM0Q&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-NiFvDIfVxTsW4...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=398828df-7dab-4804-8c60-4d8563199ba4&ssp=criteo&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10594647771379615387&ssp=criteo&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10594647771379615387&ssp=criteo&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=criteo
https://x.bidswitch.net/sync?dsp_id=419&user_id=10594647771379615387&ssp=criteo&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=&u=398828df-7dab-4804-8c60-4d8563199ba4

0
141 B

28ms
27ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=&u=398828df-7dab-4804-8c60-4d8563199ba4

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 29 May 2025 07:58:23 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //ssp-sync.criteo.com/user-sync/match?p=&u=398828df-7dab-4804-8c60-4d8563199ba4
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 29 May 2025 07:58:23 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3d7e9-2V9jYVNrbVU1TDJ6eWRmaFNCJTJGQVpncyUyQndqNSUyQnhHdzhkZ0hJSWVKSHZEWnB3JTNE%26u%3d%24UID&gdpr=0&gdpr_con...
https://ssp-sync.criteo.com/user-sync/match?p=7e9-2V9jYVNrbVU1TDJ6eWRmaFNCJTJGQVpncyUyQndqNSUyQnhHdzhkZ0hJSWVKSHZEWnB3JTNE&u=703550309037702214&gdpr=0&gdpr_consent=

0
142 B

318ms
129ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=7e9-2V9jYVNrbVU1TDJ6eWRmaFNCJTJGQVpncyUyQndqNSUyQnhHdzhkZ0hJSWVKSHZEWnB3JTNE&u=703550309037702214&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 29 May 2025 07:58:21 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=7e9-2V9jYVNrbVU1TDJ6eWRmaFNCJTJGQVpncyUyQndqNSUyQnhHdzhkZ0hJSWVKSHZEWnB3JTNE&u=703550309037702214&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.134; 206.66.99.134; 585.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 2447ef3f-9626-45be-ab6e-f09fb178fe20
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-NiFvDIfVxTsW4HwV0SDXElRX_BTvPQoZYISd_A&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=H37p0l8lMkJIczMlMkJxc0slMkZkc2xIQVB3d0lwV29SQyUyRnByeTh2VzQ3NklFejZjdVI0TW8lM0Q&u=CAESEJ-4DgZZelP_UKfBpK1hJRg&gdpr=0&gdpr_consent=&google_cver=1

0
141 B

305ms
130ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=H37p0l8lMkJIczMlMkJxc0slMkZkc2xIQVB3d0lwV29SQyUyRnByeTh2VzQ3NklFejZjdVI0TW8lM0Q&u=CAESEJ-4DgZZelP_UKfBpK1hJRg&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 29 May 2025 07:58:22 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=H37p0l8lMkJIczMlMkJxc0slMkZkc2xIQVB3d0lwV29SQyUyRnByeTh2VzQ3NklFejZjdVI0TW8lM0Q&u=CAESEJ-4DgZZelP_UKfBpK1hJRg&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 403
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4351049939433950658

0
144 B

318ms
131ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4351049939433950658

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=4351049939433950658
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 29 May 2025 07:58:21 GMT

GET
H/1.1 200
OK layer Show response
lyr.pubmatic.com/AdServer/ Frame 7CB9 478 B
670 B 276ms
112ms Script
text/html 8.28.7.87
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://lyr.pubmatic.com/AdServer/layer?pubid=159344&nwid=159344&ts=1748505499&cid=22772&pimprid=f5ez3tJlqMJ-nSAMi0-1bw&uimprid=D62A3D54-BB7C-4C0E-86DB-416E0446BEE6:0&mid=BIDVA20086TD&plen=764&a=0.73&ucrid=3842721532731928404&t=ZPWZW09R0JDTVE9PT0maWQ9MCZjaWQ9MjI3NzImeHByPTEuMDAwMDAwJmZwPTEuMjUxMTgmcHA9MC43MyZ0cD0wJnBlPTAuNDYyOTM2JnB1YmlkPTE1OTM0NCZuYmY9MSZwZmVlPTE2LjEmcGY9MTYuMSZmcmE9MSZjcD0xLjI1MTE4JmNsZW49NDI3JmNyPSUzQ3NjcmlwdCUyMHR5cGUlM0QlMjJ0ZXh0JTJGamF2YXNjcmlwdCUyMiUyMHNyYyUzRCUyMmh0dHBzJTNBJTJGJTJGbXBkLm14cHRpbnQubmV0JTJGMSUyRlMxJTJGRzElMkZUODMlMkZqcyUzRnNpeiUzRDE2MHg2MDAlMjZjcGQlM0QzMzY5NDklMjZzc2wlM0QxJTI2bWlkJTNEQjM1REFCXzEyOTExMDk2RF85OEU4RTRBJTI2YnAlM0QxLjI1MTE3OSUyNmRtJTNENDhFM0Q1QkUzNzk3NThDNjBCMTk0MjIzNjFGMUY5MTUlMjZyaSUzRDAlMjZhZGlkJTNEMSUyNnV1aWQlM0RCTVZGY0NYVlNfWDJmLU82NFdsV0NhbyUyNmd2ZSUzRDdFQ0QxRjY4QTkxMzZGNjA3MjBGODBDNUZEMkZBQTlDJTI2Z2hjJTNENjVDQjdEMDE0MDIzJTI2cHViJTNEMTU5MzQ0JTI2ZHQlM0QyJTI2c3BwbSUzRCU3QlBTUE0lN0QlMjZjbGIlM0QlMjIlM0UlM0MlMkZzY3JpcHQlM0U==
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&rnd=1732910100841748505501909&pp=1o5u328&p=1fwo5xc&crid=336949_160x600
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.87 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: Apache /
Resource Hash: e3308d7cb93b93ca9ecddf9787ab61c7a50ae383efeb981ed80e9746aa6ee002

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

Transfer-Encoding: chunked
Keep-Alive: timeout=5, max=99
Date: Thu, 29 May 2025 07:58:58 GMT
Content-Type: text/html
Server: Apache
Connection: Keep-Alive

GET
H/1.1 200 imp
aax-us-east.amazon-adsystem.com/e/dtb/ Frame 7CB9 43 B
427 B 44ms
43ms Image
image/gif 209.54.177.234
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-us-east.amazon-adsystem.com/e/dtb/imp?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&pp=1o5u328&isip=1

Requested by

Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&rnd=1732910100841748505501909&pp=1o5u328&p=1fwo5xc&crid=336949_160x600

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

209.54.177.234 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&rnd=1732910100841748505501909&pp=1o5u328&p=1fwo5xc&crid=336949_160x600

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: no-store, max-age=0
Content-Encoding: gzip
Connection: keep-alive
x-amz-rid: 8F2YJ371NF2QDVEP0H76
Date: Thu, 29 May 2025 07:58:22 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H/1.1 200
OK / Show response
ts.amazon-adsystem.com/ Frame 7CB9 3 KB
4 KB 331ms
109ms Script
application/javascript 2600:9000:28a3:4000:1c:d13c:df40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ts.amazon-adsystem.com/?s=%7B%22sourceid%22%3A%22600%22%2C%22expname%22%3A%22UNITAG_DISPLAY_ROLLOUT_5500%22%2C%22expbucket%22%3A%22C%22%2C%22sourcetype%22%3A%22dtb%22%2C%22traffictype%22%3A%22web%22%2C%22mediatype%22%3A%22display%22%7D&p=%7B%22bidRequestId%22%3A%22f5ez3tJlqMJ-nSAMi0-1bw%22%2C%22tungstenCSMLoggingFrameworkUrl%22%3A%22tungsten-service.prod.na.adsqtungsten.a9.amazon.dev%2Fcsm%2F%22%2C%22tsEndpoint%22%3A%22https%3A%2F%2Fsq-tungsten-ts.amazon-adsystem.com%2Fnoop%2F%22%2C%22au%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FRCs0cgrpEKkWchW9gCFZ100AAAGXGwyiFAEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o%2F%3Ft%3D%2524%257BAAX_TYPE%257D%26p%3D%2524%257BAAX_PAYLOAD%257D%26bx%3Dv1_CGrnR1xsq_rx_yqvQ8IPhiTraVV6Cv9svoh9nmLSr5PwD-0eja0iiMQLuDN-jRqphJEi5qZMtXWSngKfZzVCPjCVUVP5ZK-RcBtVOAcvFR3wTcAk93C89LcVDUXsCMSPeqanFTeshOI-SBdV43r-TVZpJ2YqK8NWQgtnAPV_M0vjwuCA2fdT3CImdHtoFdt8q8GIQtQjIg%22%2C%22zone%22%3A%22USEast%22%2C%22ntdUrl%22%3A%22www.btd-cmh.tq-tungsten.com%2F%22%2C%22ep%22%3A%5B%22vue%22%2C%22forensics%22%2C%22forensics-ntd%22%2C%22pst%22%5D%2C%22pm%22%3A%7B%22ac%22%3A%5B%22au%22%5D%2C%22at%22%3A%5B%22instrUrl%22%5D%2C%22av%22%3A%5B%22au%22%5D%2C%22v%22%3A%5B%22instrUrl%22%5D%7D%2C%22targetElement%22%3A%22window%22%2C%22instrUrl%22%3A%22https%3A%2F%2Faax-us-east.amazon-adsystem.com%2Fx%2Fpx%2FJCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o%2F%22%2C%22bidId%22%3A%22KzRyCukQqRZyFb2AIVnXTQ%22%7D
Requested by: Host: aax-us-east.amazon-adsystem.com
URL: https://aax-us-east.amazon-adsystem.com/e/dtb/admi?b=JCs0cgrpEKkWchW9gCFZ100AAAGXGwyZTgEAAAJYAQBhcHNfdHhuX2JpZDIgICBhcHNfdHhuX2ltcDEgICD9tY9o&rnd=1732910100841748505501909&pp=1o5u328&p=1fwo5xc&crid=336949_160x600
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a3:4000:1c:d13c:df40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5424233511846a326a52f947e1990428ad13704e07f83322768fccc5a3a935c7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://aax-us-east.amazon-adsystem.com/

Response headers

x-amz-version-id: aPMJW3y5A9zX_RworiSbCls_mbhBIqE8
ETag: "ef3694a9089a0cacc9efb8dd0a80c5ee"
Age: 75064
Connection: keep-alive
Via: 1.1 3a9d4d1041bb08dacfca557811c818c0.cloudfront.net (CloudFront)
Accept-Ranges: bytes
X-Cache: Hit from cloudfront
Content-Length: 3246
X-Amz-Cf-Id: keeHC3RolRuEogwsSrVYtKGxwTrvJ-PQVY4ZuOSjlse5NBvLexobpA==
Date: Wed, 28 May 2025 11:07:19 GMT
Content-Type: application/javascript
Last-Modified: Thu, 24 Apr 2025 15:57:18 GMT
Server: AmazonS3
X-Amz-Cf-Pop: IAD61-P8
x-amz-server-side-encryption: AES256

GET
H2 200 match Show response
c1.adform.net/serving/cookie/ Frame 4F67 35 B
591 B 115ms
114ms Document
image/gif 185.167.164.40
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?party=14&cid=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.40 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 29 May 2025 07:58:22 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame F001 43 B
855 B 45ms
45ms Document
image/gif 98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=A19DB13A-2A7F-4342-A829-C213A3B20202&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 29 May 2025 07:58:22 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: JZVZEF47KMCECQ1G05MY

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 36F9
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=703550309037702214&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

54ms
51ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 0050
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFJRk4wN1FjQ2NBQUJzc1dVcEoyZw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AAIFN07QcCcAABssWUpJ2g&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_par...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAIFN07QcCcAABssWUpJ2g&pid=558502&do=add&gdpr=0
https://rtb-csync.smartadserver.com/redir?partneruserid=AAIFN07QcCcAABssWUpJ2g&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=4992565638815235626&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAIFN07QcCcAABssWUpJ2g&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:23 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame B875 0
339 B 285ms
139ms Document
image/gif 8.18.47.7
DEEPINTENT

General

Check archive.org

Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.18.47.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

content-length: 0
content-type: image/gif
date: Thu, 29 May 2025 07:58:22 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: a

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AEA6
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2809753636510020615
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

32ms
30ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame FA5C
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=imdJN3LmVEBf-sk-Mehfyc5CY4Y&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=fb69f108-4022-4e05-ad19-ead049a678ca
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:24 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame DA84
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_...

85 B
151 B

78ms
77ms

Document
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDgTngAFA-EqNQAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 141
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 29 May 2025 07:58:22 GMT
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 93
x-robots-tag: noindex
x-served-by: cache-ewr-kewr1740032-EWR
x-timer: S1748505502.404935,VS0,VE0

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=0&gdpr_consent=&_test=aDgTngAFA-EqNQAw
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-robots-tag: noindex
x-served-by: cache-ewr-kewr1740032-EWR
x-timer: S1748505502.339925,VS0,VE7

GET pubmatic
ad.mrtnsvr.com/sync/ Frame 48BE 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame AFAF
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=0&gdpr_consent=&us_privacy=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_user_id=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=0&gdpr_consent=&us_privacy=
https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=fe939e1f-4a10-49e8-b0b4-9af49fcfef52&ssp=pubmatic&gdpr=0
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=

1 B
222 B

39ms
38ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 1
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, must-revalidate
content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=398828df-7dab-4804-8c60-4d8563199ba4&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
via: 1.1 google

GET
H/1.1

200
OK

pbmtc.gif Show response
beacon.lynx.cognitivlabs.com/ Frame 9EC6
Redirect Chain

https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=84de5b93-ac0e-41e2-a4b7-fb4418a22934&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=A19DB13A-2A7F-4342-A829-C213A3B20202

42 B
495 B

41ms
38ms

Document
image/gif

3.215.67.115
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=A19DB13A-2A7F-4342-A829-C213A3B20202
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.67.115 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-67-115.compute-1.amazonaws.com
Software: Kestrel /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 42
Content-Type: image/gif
Date: Thu, 29 May 2025 07:58:22 GMT
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=A19DB13A-2A7F-4342-A829-C213A3B20202
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame F95E
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=${...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw&piggybackCookie=$TF_USER_ID_ENC$&gdpr=0&gdpr_consent=&u=...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

4ms
3ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame ABEC
Redirect Chain

https://cs.krushmedia.com/d0d3910d86e99acbd84ac90b691dc0c5.gif?puid=[UID]&redir=[RED]&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&ccpa=[CCPA]&coppa=[COPPA]
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM4NTgmdGw9NDMyMDA=&piggybackCookie=ace7f49b-6e48-5e58-98a4-5c7a8f9b6660&gdpr=0&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]

0
0

71ms
70ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=[GDPR_CONSENT]&us_privacy=[CCPA]
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 70D1
Redirect Chain

https://t.adx.opera.com/pub/sync?pubid=pub8730968190912&gdpr=0&gdpr_consent=
https://www.temu.com/api/adx/cm/pixel-opera?adx_uid=edc2f1028dc8843a&gdpr=0&gdpr_consent=&us_privacy=&redir=https%3A%2F%2Ft.adx.opera.com%2Fsync%3Fvendor%3D60369%26pubid%3Dpub8730968190912
https://t.adx.opera.com/sync?vendor=60369&pubid=pub8730968190912
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0ODkmdGw9NDMyMDA=&piggybackCookie=OPU455cdb2322e5495a818825dac32702f8
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:23 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 223E
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=&__qcmcs=1
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=kHHJ65d6w7aLccK1lSjX5cJ8ybeLec_ilCrhQ7bL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 40D8
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0

0
74 B

38ms
37ms

Document
text/html

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Thu, 29 May 2025 07:58:22 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&gdpr_consent=null&piggybackCookie={viewer_token}&gdpr=0
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame 278E 43 B
346 B 296ms
102ms Document
image/gif 35.186.193.173
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Thu, 29 May 2025 07:58:21 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
via: 1.1 google

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame CA44
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=b1346814-3c62-11f0-9c1c-32381e2c7024
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

6ms
6ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:22 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame 5A42
Redirect Chain

https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://creativecdn.com/cm-notify?pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&tc=1
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNTQmdGw9NDMyMDA%3D&piggybackCookie=j1iG-c9Grvhx1XoxMoQBjdaIswvGlCG6ytQ7zH0Bu2w&pi=pubmatic&gdpr=0&gdpr_consent=&us_privacy=&g...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Document
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private,max-age=86400
date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
date: Thu, 29 May 2025 07:58:23 GMT
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

GET
H/1.1 404
Not Found pubmatic&gdpr=0&gdpr_consent= Show response
sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/ Frame F961 0
181 B 307ms
98ms Document
text/html 159.89.252.170
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.resetdigital.co/csync/pubmatichttps://sync.resetdigital.co/csync/pubmatic&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.252.170 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache, no-store, must-revalidate
content-length: 0
content-type: text/html
date: Thu, 29 May 2025 07:58:22 GMT

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame AC74
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=A19DB13A-2A7F-4342-A829-C213A3B20202
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOqxKEop--0tO1cbuPoqsMg&google_cver=1

42 B
60 B

80ms
79ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOqxKEop--0tO1cbuPoqsMg&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEOqxKEop--0tO1cbuPoqsMg&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 289
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

mw
mwzeom.zeotap.com/ Frame AC74
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=0&gdpr_consent=
https://cms.analytics.yahoo.com/cms?partner_id=DELI&gdpr=0
https://ups.analytics.yahoo.com/ups/58679/cms?partner_id=DELI&gdpr=0
https://pixel.onaudience.com/?partner=252&mapped=y-ik3hiuRE2pRGl4gcAXtpyb97XGHcsU6L4w--~A&gdpr=0
https://spl.zeotap.com/?zdid=1332&zcluid=f7ab043882ff53f5
https://cm.g.doubleclick.net/pixel?google_nid=zeotap_ddp&google_cm&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=526784c3-a3ce-44f1-57ea-a6a49f5a4f4d&reqId=40c3e623-54ba-4baa-5d85-d064b746f84c&zclui...
https://mwzeom.zeotap.com/mw?google_gid=CAESEOVfLr0o94_zuGD4hUuzDg4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=526784c3-a3ce-44f1-57ea-a6a49f5a4f4d&reqId=40c3e623-54ba-4baa-5d85-d06...

95 B
165 B

116ms
108ms

Image
image/png

2606:4700::6812:1572
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://mwzeom.zeotap.com/mw?google_gid=CAESEOVfLr0o94_zuGD4hUuzDg4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=526784c3-a3ce-44f1-57ea-a6a49f5a4f4d&reqId=40c3e623-54ba-4baa-5d85-d064b746f84c&zcluid=f7ab043882ff53f5&zdid=1332

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2606:4700::6812:1572 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=2592000; includeSubDomains; preload
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
x-content-type-options: nosniff
via: 1.1 google
cf-ray: 947472451c4abdbc-EWR
access-control-allow-origin: https://ads.pubmatic.com
content-length: 95
date: Thu, 29 May 2025 07:58:23 GMT
content-type: image/png
vary: Origin
server: cloudflare
access-control-allow-headers: *

Redirect headers

cache-control: no-cache, must-revalidate
location: https://mwzeom.zeotap.com/mw?google_gid=CAESEOVfLr0o94_zuGD4hUuzDg4&google_cver=1&zpartnerid=1&env=mWeb&eventType=map&id_mid_4=526784c3-a3ce-44f1-57ea-a6a49f5a4f4d&reqId=40c3e623-54ba-4baa-5d85-d064b746f84c&zcluid=f7ab043882ff53f5&zdid=1332
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 469
date: Thu, 29 May 2025 07:58:23 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame AC74
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=A19DB13A-2A7F-4342-A829-C213A3B20202&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=A19DB13A-2A7F-4342-A829-C213A3B20202&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=A19DB13A-2A7F-4342-A829-C213A3B20202
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=44f25091-72f5-4666-b23b-1d65550b9b76
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=44f25091-72f5-4666-b23b-1d65550b9b76
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=703550309037702214&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=4351049939433950658&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
169 B

27ms
27ms

Image
image/png

151.101.130.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDgTnwAAFN0NBwBa
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.130.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1748505504.691602,VS0,VE0
age: 1823
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 29 May 2025 07:58:23 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740032-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 145

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aDgTnwAAFN0NBwBa
x-timer: S1748505504.654220,VS0,VE8
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 29 May 2025 07:58:23 GMT
x-served-by: cache-ewr-kewr1740032-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEPUkc9IHSemuomQc-gIub_4&google_cver=1
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
40 B

256ms
26ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:E58D64572E3F418F8BAC95AA0255C0EF
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
40 B

193ms
27ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=44f25091-72f5-4666-b23b-1d65550b9b76&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
40 B

227ms
34ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=A19DB13A-2A7F-4342-A829-C213A3B20202&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6oOHgK9E2uX3Cf33Q9TwuivBg2aTSco-~A&gdpr=0

0
260 B

169ms
53ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6oOHgK9E2uX3Cf33Q9TwuivBg2aTSco-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-6oOHgK9E2uX3Cf33Q9TwuivBg2aTSco-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 29 May 2025 07:58:22 GMT
content-type: text/html
server: ATS

GET
H2 200 A19DB13A-2A7F-4342-A829-C213A3B20202
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AC74 43 B
519 B 123ms
108ms Image
image/gif 2600:1f18:4e9:5a05:a666:44cf:f5df:d70
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/A19DB13A-2A7F-4342-A829-C213A3B20202?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a05:a666:44cf:f5df:d70 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=f6e5f515-3ab0-4f3d-9413-8bb09ec9762b&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=eb28117b-0e58-4206-b1a7-535ecba7090a
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:24 GMT
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=6bc78ea8219807b1&is_secure=true&networkId=17100&version=1&nuid=A19DB13A-2A7F-4342-A829-C213A3B20202&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQANe6AFv-UxsgIPhMWxAQEBAQEBAQCWGg2lFwEBAQEBAQEB&expiration=1748591902&nuid=A19DB13A-2A7F-43...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
126 B

73ms
36ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

GET
H2 204 CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame AC74 0
163 B 306ms
78ms Image
text/plain 44.194.64.132
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.194.64.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-194-64-132.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=f213e19d-75fa-4605-8be6-6105f0b8ee13-6838139c-5553&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=fb69f108-4022-4e05-ad19-ead049a678ca
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:24 GMT
server: nginx

GET
H2

204

ImgSync
image8.pubmatic.com/AdServer/ Frame AC74
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=4351049939433950658&gdpr=0&gdpr_consent=&us_privacy=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://match.adsby.bidtheatre.com/pubmaticmatch?redirected=true
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MjAxNjA=&gdpr=&gdpr_consent=&piggybackCookie=eb28117b-0e58-4206-b1a7-535ecba7090a
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=

0
0

0ms
0ms

Image
text/plain

207.65.32.82
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
Protocol: H2
Server: 207.65.32.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 29 May 2025 07:58:22 GMT
cache-control: private,max-age=86400
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control: no-store, no-cache, private
location: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:24 GMT
server: nginx

GET
H/1.1

200
OK

sn.ashx
pmp.mxptint.net/ Frame AC74
Redirect Chain

https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R37AA5_12911098A_2BE4C4661&r=https://pmp.mxptint.net/sn.ashx?ak=1
https://pmp.mxptint.net/sn.ashx?ak=1

43 B
289 B

36ms
35ms

Image
image/gif

38.68.201.140
COGENT-174

General

Check archive.org

Download Go to Show image

Full URL

https://pmp.mxptint.net/sn.ashx?ak=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

HTTP/1.1

Server

38.68.201.140 Ashburn, United States, ASN174 (COGENT-174, US),

Reverse DNS

Software

Kestrel /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=-431510302; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

Transfer-Encoding: chunked
Strict-Transport-Security: max-age=-431510302; includeSubDomains
Cache-Control: no-cache
Date: Thu, 29 May 2025 07:58:22 GMT
Pragma: no-cache
Content-Type: image/gif
Server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://pmp.mxptint.net/sn.ashx?ak=1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 29 May 2025 07:58:22 GMT
server: nginx

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 197ms
195ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

504f2225279a1aa10d1138f2d07c7147168a7f1e44769e811cccd52c6fb8e834

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: application/json
vary: Origin

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 111ms
110ms Fetch
text/html 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202505200101/pubads_impl.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame E012
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=aDgTnkt3ua0AKHrNATYnpwAABNkAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEIukwMz68pypt0WAr-sjP4A&google_cver=1

43 B
803 B

49ms
49ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEIukwMz68pypt0WAr-sjP4A&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1
Protocol: H3
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5dx19SNyMFoniSIZiDR7F5nhyCSNnXvuQaFMGgGdoSksEi%2B69X6m81LqX1K%2FUMouiuO2LHhBPlQ6FlZWVGC3YKp6yAQn6l54JNBxhcnEbI1vAWgvh%2FF%2FoLS%2FsFueb7JQjfKTw0FMZ7U%2Big%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=3,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 9474723f7fcbc47f-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEIukwMz68pypt0WAr-sjP4A&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 364
date: Thu, 29 May 2025 07:58:22 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

s.pixel
pixel.idmap.ai/adscores/ Frame E012
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=aDgTnkt3ua0AKHrNATYnpwAA%261241&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://he.lijit.com/merge?pid=8100&event_type=email&lc_md5=9f37e120704c87672b8066b824e2d4ec&lc_sha1=1110a64959fa3192677c404175ccc2418b37e1a4&lc_sha256=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b...
https://pixel.idmap.ai/adscores/s.pixel?pid=1002&sha256=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b11f088c1dfc4c06d3e9&sha1=1110a64959fa3192677c404175ccc2418b37e1a4&md5=9f37e120704c87672b8066b824...

42 B
328 B

815ms
467ms

Image
image/gif

94.130.49.186
HETZNER-AS Hetzne...

General

Check archive.org

Download Go to Show image

Full URL

https://pixel.idmap.ai/adscores/s.pixel?pid=1002&sha256=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b11f088c1dfc4c06d3e9&sha1=1110a64959fa3192677c404175ccc2418b37e1a4&md5=9f37e120704c87672b8066b824e2d4ec&cookies=Kva-ALZH_zDhuONZRriUqleg

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fgpp%3D%26bidder%3Dix%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D&gdpr=&gdpr_consent=&gpp=&gppsid=&s=184674&us_privacy=&C=1

Protocol

Server

94.130.49.186 Falkenstein, Germany, ASN24940 (HETZNER-AS Hetzner Online GmbH, DE),

Reverse DNS

94-130-49-186.ptr

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

2d64623d7cca2ddbc0255cca23010f5d173cc8a077c91ba96c79ca00a611ee58

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ssum-sec.casalemedia.com/

Response headers

strict-transport-security: max-age=2592000
content-encoding: gzip
expires: Wed, 01 Jan 1997 12:00:00 GMT
date: Thu, 29 May 2025 07:58:23 GMT
content-type: image/gif
vary: Accept-Encoding
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

Redirect headers

cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location: https://pixel.idmap.ai/adscores/s.pixel?pid=1002&sha256=6bb465d4d2db0fd0ad5fcc1bae7b0196177c9e97f6a8b11f088c1dfc4c06d3e9&sha1=1110a64959fa3192677c404175ccc2418b37e1a4&md5=9f37e120704c87672b8066b824e2d4ec&cookies=Kva-ALZH_zDhuONZRriUqleg
pragma: no-cache
expires: Fri, 20 Mar 2009 00:00:00 GMT
content-length: 43
date: Thu, 29 May 2025 07:58:22 GMT
content-type: image/gif
server: awselb/2.0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame E012 43 B
855 B 87ms
82ms Image
image/gif 98.82.154.76
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=aDgTnkt3ua0AKHrNATYnpwAABNkAAAIB&gpp=&gpp_sid=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.154.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS