paint.toys Open in urlscan Pro
3.33.186.135 Public Scan

Software

Netlify /

Resource Hash

70883a9270d54ca9914810ee600c39f62c1147243374c8b93b7095f9c78b4b66

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 24826
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-encoding: br
content-length: 1632
content-type: text/html; charset=UTF-8
date: Thu, 12 Jun 2025 02:04:13 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
server: Netlify
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01JXGY2VEFYTF99YB7KMA9G2JS

Redirect headers

accept-ranges: bytes
age: 6921
cache-control: public,max-age=0,must-revalidate
cache-status: "Netlify Edge"; hit
content-length: 1669
content-type: text/html; charset=UTF-8
date: Thu, 12 Jun 2025 02:04:13 GMT
etag: "7afa2eee23cef4ed7f87aab76b5bc74d-ssl-df"
location: /oil/
server: Netlify
strict-transport-security: max-age=31536000
x-nf-request-id: 01JXGY2VCTWYHSM215F8V5NV3F

GET
H2 200 ramp_config.js Show response
cdn.intergient.com/1024872/74068/ 36 KB
6 KB 217ms
98ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab20928f73c03466a6c82a12070c51caef2096984856ce7a5e4310afe204375c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 94e5c6b728f4005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apps.css
paint.toys/ 5 KB
1 KB 39ms
37ms Stylesheet
text/css 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/apps.css

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

2ff696f311f1afa7aafddb260becd45331aab7ce1741821b0f3e2d9e683382b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "58d01e65c6625681e8891f6fbc8c18f5-ssl-df"
age: 9245
accept-ranges: bytes
content-length: 1394
x-nf-request-id: 01JXGY2VFTKTSV669HVBD9HHFF
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 index.js Show response
paint.toys/oil/ 4 KB
1 KB 71ms
69ms Script
application/javascript 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://paint.toys/oil/index.js

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

c91c09319c4b0a24c72c0036cef74c17b85d3c4e2a4abf8153f5710421fe5b4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
content-encoding: br
etag: "687211e2ced405124b38663a13c97091-ssl-df"
age: 6921
accept-ranges: bytes
content-length: 1206
x-nf-request-id: 01JXGY2VFT7H95KVGAASJNCF90
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
server: Netlify

GET
H2 200 art-icon.png
paint.toys/assets/ 33 KB
33 KB 37ms
36ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/art-icon.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

f4d368e4230539c778afbb020e0ea611b3e1d984179f5b3769b44081d6703f3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "1394f8469f2ca5750397e3d7b6ec70a1-ssl"
age: 16258
accept-ranges: bytes
content-length: 33562
x-nf-request-id: 01JXGY2VFTJMF0Y4GZEGGEYYXW
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-hand.png
paint.toys/assets/ 27 KB
27 KB 55ms
53ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-hand.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

32aa05a5648678542ab9044647f0bf5549c0b53a070585edb773f0e92b72b97d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "a0822110a4671ffdf710da1467460fba-ssl"
age: 9245
accept-ranges: bytes
content-length: 27394
x-nf-request-id: 01JXGY2VFTWDGNBGEKY987KVQK
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-disk.png
paint.toys/assets/ 13 KB
14 KB 35ms
35ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-disk.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

436814c2374a6d92a42a02d39969ef7c56b5f225667abecb218e692c5569943c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "26852fa1548a91e004629b01e4abf1dd-ssl"
age: 9245
accept-ranges: bytes
content-length: 13766
x-nf-request-id: 01JXGY2VJ1XK0MPHHGQ6PZH2JW
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: image/png
server: Netlify

GET
H2 200 icon-trash.png
paint.toys/assets/ 50 KB
51 KB 59ms
57ms Image
image/png 3.33.186.135
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://paint.toys/assets/icon-trash.png

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.33.186.135 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Netlify /

Resource Hash

6ceb226c487cb85243545e768944e0e1ae0944be8fde6c1c43c7314a9287e6d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/oil/

Response headers

strict-transport-security: max-age=31536000
cache-control: public,max-age=0,must-revalidate
etag: "e91ef5e34b5154d392e8560031eaaa4c-ssl"
age: 9245
accept-ranges: bytes
content-length: 51680
x-nf-request-id: 01JXGY2VJKQA3NSMQQEC7NWQTT
cache-status: "Netlify Edge"; hit
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: image/png
server: Netlify

GET
H2 200 ramp_core.js Show response
cdn.intergient.com/ 3 KB
2 KB 95ms
49ms Script
application/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/ramp_core.js
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a309649af311e2b2560b8f9182050f5bdf19e05948ca3c34c1e6ec356f98fe4d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
cache-control: max-age=600, public, must-revalidate
content-encoding: br
cf-ray: 94e5c6b728f6005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 380 KB
131 KB 184ms
65ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

21f740307eb0eb7dc94d26b5c0b3545892b5cdb464a4caace369cd655c19485f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 12 Jun 2025 02:04:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 133041
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 rhtp14sqsfk3 Show response
faucetfoot.com/build/ 68 KB
25 KB 190ms
60ms Script
text/javascript 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/build/rhtp14sqsfk3

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1849279123 /

Resource Hash

274ffdafd98bdb7a8b3466361a3c980fac34ae988793ea6ed064cc409a6b31c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: private, must-revalidate, max-age=21600
timing-allow-origin: *
content-encoding: zstd
etag: W/"2eb49be9869ae7585ceb52bb81913c985ee5dd6373371eeb1d2f48bf13ed713d"
via: fen-hoothoot-us-east1-spot-zzqg.gce-us-east1, 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding, Accept-Language
server: hoothoot/1849279123

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 178ms
54ms Script
text/javascript 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dfb25c17899f64839dd5f61b3f0ed18a62e9a9da605b0e2a85b4f67b1a74253d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 646 / 20251 / 31092945 / config-hash: 6801673682319888518
x-content-type-options: nosniff
expires: Thu, 12 Jun 2025 02:04:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 34114
x-xss-protection: 0
server: cafe

GET
H2 200 prebid.js Show response
cdn.intergient.com/prebid/ 595 KB
182 KB 53ms
53ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/prebid/prebid.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/1024872/74068/ramp_config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e31ebd912f7c75533c2457432788b358fc7cf88f05702be8ee3ba89940e19a73

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"74587ae5be2a7e57c39a5102d6995eb6"
age: 4897
cf-ray: 94e5c6b7bb21005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript
last-modified: Thu, 05 Jun 2025 13:40:15 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 pageos.js Show response
cdn.intergient.com/pageos/V.20250609.1/ 411 B
365 B 45ms
45ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/pageos.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 341a2dce8a5c43279f271e29582c1bf7bd30318860be6ae7d93ca59a0a23cc8d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"0db4e42bb65ad429f7d589d07ff079d2"
age: 3249
cf-ray: 94e5c6b7cb55005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:16 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 paint.toys Show response
cdn.intergi.com/bot_score/publisher/74068/domain/ 22 B
415 B 139ms
47ms Script
application/javascript 2606:4700::6812:18f2
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergi.com/bot_score/publisher/74068/domain/paint.toys?path=%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/ramp_core.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:18f2 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bebdfcd7d846226186525a5e375b8f480bb6fe115f2f0f8d2f4b0d86256e0f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache
cf-ray: 94e5c6b868de4337-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
content-length: 22
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript
vary: Accept-Encoding
server: cloudflare
priority: u=3,i=?0

GET
H2 200 runtime.7ab61523d24414456401.js Show response
cdn.intergient.com/pageos/V.20250609.1/ 3 KB
2 KB 49ms
47ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/runtime.7ab61523d24414456401.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 369830adb54331223e5af9d725d5997683f367eee978a8ed396fa3edd71795e0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"de6c0dd56b5d2db5317dfd229b2fe504"
age: 2911
cf-ray: 94e5c6b81ca8005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:18 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 main.9fdb42b795b5a6edfd18.js Show response
cdn.intergient.com/pageos/V.20250609.1/ 525 KB
160 KB 53ms
51ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/pageos.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a0ec2368ea6c6318bce34d0de967de536d6f11ac3222b0889f85dab67330c12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"d731ca9611c2c3ef23cf7372a30ca22e"
age: 2911
cf-ray: 94e5c6b81cac005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:14 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 318 KB
115 KB 48ms
47ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je56a1v9101576445za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104617979~104617981~104661466~104661468~104718207

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f6537ddbcd516f6ae6f7d15ae56d23eeb11e45e2e1b42324619b93dea5e3896

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 12 Jun 2025 02:04:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 117722
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 192ms
70ms Fetch
text/plain 2607:f8b0:4004:c25::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-VJBRK9986D&gtm=45je56a1v9101576445za200&_p=1749693853168&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104617979~104617981~104661466~104661468~104718207&cid=1210169937.1749693854&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1749693853&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&dt=Paint%20with%20Oils&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1406
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-VJBRK9986D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c25::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to: {"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:102:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 videoCard.5ed8eb34c11835040def.js Show response
cdn.intergient.com/pageos/V.20250609.1/ 559 B
444 B 43ms
43ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/videoCard.5ed8eb34c11835040def.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/runtime.7ab61523d24414456401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 795041923e6338abe450ff9524ef70fd40432f278f32c9c35cdbb08239574fb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"6880c1609e3243c11c7b4f1285e14d89"
age: 2910
cf-ray: 94e5c6ba1c97005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:21 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250609.1/iframe/ Frame E184 503 B
427 B 291ms
101ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa032733b554bc9dc7d217f75d8ff7412776ecfd6a6d9f0c545e44586272b19b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 2911
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 94e5c6bb4e2049aa-EWR
content-encoding: br
content-type: text/html
date: Thu, 12 Jun 2025 02:04:13 GMT
hw-country-code: US
last-modified: Wed, 11 Jun 2025 15:09:12 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 iframe.html Show response
cdn.intergient.com/pageos/V.20250609.1/iframe/ Frame E77D 503 B
0 288ms
288ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa032733b554bc9dc7d217f75d8ff7412776ecfd6a6d9f0c545e44586272b19b

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 2911
alt-svc: h3=":443"; ma=86400
cf-cache-status: HIT
cf-ray: 94e5c6bb4e2049aa-EWR
content-encoding: br
content-type: text/html
date: Thu, 12 Jun 2025 02:04:13 GMT
hw-country-code: US
last-modified: Wed, 11 Jun 2025 15:09:12 GMT
server: cloudflare
vary: Accept-Encoding

GET
H2 200 USA Show response
impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/22/desktop/Chrome/ 585 B
920 B 221ms
42ms XHR
application/json 2600:9000:24f1:9200:b:99e7:bb00:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://impression-inferences-edge-prod.playwire.com/websites/74068/v1/Wed/22/desktop/Chrome/USA
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f1:9200:b:99e7:bb00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 4f99988d68e5fc257e27d859964f8fda278560925f0293353ac603c6a7564614

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600, public, must-revalidate
access-control-expose-headers: *
age: 155
via: 1.1 25c8a58d4773aeef98fa0f0f950689bc.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Hit from cloudfront
content-length: 585
x-amz-cf-id: oEdJ5TWgyXF0obhPfvK8v2UjifJdO9gv5cmPuBv72u7Czo2cu49mxQ==
date: Thu, 12 Jun 2025 02:01:38 GMT
content-type: application/json
x-amz-cf-pop: JFK50-P4
server: CloudFront

GET
H2 200 tag Show response
btloader.com/ 152 KB
41 KB 205ms
61ms Script
application/javascript 2606:4700:10::6816:4ad8
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:4ad8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b3f9902bdab0e644ffe3e973c55cb127fa92349d013fb235f0ba75eb67baeb8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-robots-tag: noindex, nofollow
cache-control: public, max-age=300, stale-if-error=3600, stale-while-revalidate=300
content-encoding: gzip
cf-cache-status: HIT
etag: "c200c425732f77da449fb3b3219b9b04"
via: 1.1 google
cf-ray: 94e5c6bb3b634367-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 41529
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/javascript
last-modified: Thu, 12 Jun 2025 01:44:26 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 378 KB
91 KB 200ms
51ms Script
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 829c0d2a0547e392bc4df433e0a98dc0ee236e800bb79104e12b9f8f9f38fd92

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: max-age=3600
content-encoding: gzip
etag: W/"2e24377a93920eafcb2c34046caa1a58"
age: 2358
via: 1.1 5043a37395ddf7859d2515fd2a9125d6.cloudfront.net (CloudFront), 1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: sEvV516_DEPlG8iSeAwALQqwlXKj39BPCID1D0isAFTO4FU2ZsLTCw==
date: Thu, 12 Jun 2025 01:24:56 GMT
content-type: application/javascript
last-modified: Tue, 10 Jun 2025 23:57:15 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P7, JFK50-P3
x-amz-server-side-encryption: AES256

GET
H2 200 1x1.gif
raw.githubusercontent.com/easylist/easylist/master/docs/ 43 B
585 B 158ms
54ms Image
image/gif 2606:50c0:8002::154
FASTLY

General

Check archive.org

Download Go to Show image

Full URL

https://raw.githubusercontent.com/easylist/easylist/master/docs/1x1.gif

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8002::154 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; sandbox
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-fastly-request-id: c69b173d16f0e369e136ec34831930c7e71e21f7
etag: W/"0c4a5773f7e435c57c40bd270aef756513eba26bd7ba5317b5bd765569a7325d"
x-content-type-options: nosniff
x-github-request-id: 080B:278E73:143605:17C039:6849688B
expires: Thu, 12 Jun 2025 02:09:13 GMT
x-cache: HIT
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: image/gif
x-served-by: cache-ewr-kewr1740061-EWR
x-cache-hits: 36
source-age: 272
x-frame-options: deny
strict-transport-security: max-age=31536000
vary: Authorization,Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
cache-control: max-age=300
x-timer: S1749693854.911056,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 43
x-xss-protection: 1; mode=block

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/17138/ 43 KB
13 KB 221ms
46ms Script
text/javascript 3.167.69.77
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-77.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a1b70ca670ab8ac2ebf163fbedfd4d65b1a8e33c9277dee78468072d25aa605f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"7ac6dd54487d8f654726122eb9bd814d"
age: 73609
via: 1.1 c8e5a51ce52caf510dff11d206de43ac.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: CalKJz_yo6AWFua3ZODsyGKQ16O1Llfv2W9vb-zhSZzghYXo5Q1KzA==
date: Wed, 11 Jun 2025 05:37:24 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:56:33 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/ 542 KB
171 KB 38ms
38ms Script
text/javascript 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7de0983ffbeb9f074cc4c2edf9e628c72670462ef3afe5fa8da949127ebbe14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 11765304927842507682
age: 57191
x-content-type-options: nosniff
expires: Thu, 11 Jun 2026 10:11:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 11 Jun 2025 10:11:02 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 174794
x-xss-protection: 0
server: cafe

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
482 B 224ms
85ms Image
image/gif 2600:9000:28a9:5600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?ab=1&zoneid=498261_advertisement_
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:28a9:5600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
age: 815833
x-cache: Hit from cloudfront
x-amz-cf-id: jwoT_inLDVWYI1koimttq_NS65XjqioiSi0x_7mLkAD52PpLCZbRYw==
date: Mon, 02 Jun 2025 15:27:02 GMT
content-type: image/gif
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 04eae9f89d461f79682103da6d0e3f4e.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 43
x-amz-cf-pop: IAD89-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 46ms
44ms Fetch
text/plain 2607:f8b0:4004:c25::65
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CEFZJ359V8&gtm=45je56a1v9102396898za200zb9101576445&_p=1749693853168&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104617979~104617981~104661466~104661468~104718207~104736442~104736444&cid=1210169937.1749693854&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1749693853&sct=1&seg=0&dl=https%3A%2F%2Fpaint.toys%2Foil%2F&dr=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&dt=Paint%20with%20Oils&en=ramp_js&_fv=1&_ss=1&_ee=1&ep.pageview_id=1749693853168&tfd=1782
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CEFZJ359V8&cx=c&gtm=45je56a1v9101576445za200&tag_exp=101509157~103116026~103200004~103233427~103351869~103351871~104617979~104617981~104661466~104661468~104718207
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c25::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:102:0
report-to: {"group":"ascnsrsggc:102:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:102:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://paint.toys
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:102:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202506100101/ 63 KB
23 KB 84ms
82ms Other
text/plain 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202506100101/gpt

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73bd4c8987df0f6123cfb0ba8eec8f4ee06f9f7d3056b080cf4c1b38e309469f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 871216923647474696
age: 4072
x-content-type-options: nosniff
expires: Thu, 19 Jun 2025 00:56:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 12 Jun 2025 00:56:22 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23657
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202506100101"

GET
H2 200 154013155 Show response
fundingchoicesmessages.google.com/i/ 203 KB
66 KB 356ms
184ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/i/154013155?ers=3

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0d77de35e49321aa1bc543c46da6700de9047b45062137b83a3414bf48c789a5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-S_wxEajSBzTAFbgyPiJ1lQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw0pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8RrNt5i3QrEZn63We2AuHD6bdZKIBbi4Zj3esUhNoEbiz_sZlTSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAzsNQzMIovMAAA_fo9dA"
content-security-policy: script-src 'report-sample' 'nonce-S_wxEajSBzTAFbgyPiJ1lQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250609.1/iframe/ Frame E184 17 KB
7 KB 45ms
44ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 2912
cf-ray: 94e5c6bc39a349aa-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 iframe.js Show response
cdn.intergient.com/pageos/V.20250609.1/iframe/ Frame E77D 17 KB
0 39ms
39ms Script
text/javascript 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3cf4e88b472433e2273c4de0a7fceb430f0f3ac49425ec77a99697a944d53ec4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://cdn.intergient.com/pageos/V.20250609.1/iframe/iframe.html

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"31bb1614c114425ef27f97d72f81a6e3"
age: 2912
cf-ray: 94e5c6bc39a349aa-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:12 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 dns Show response
ag.dns-finder.com/meta/ 2 B
233 B 258ms
113ms Fetch
text/plain 34.36.200.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://ag.dns-finder.com/meta/dns
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.200.111 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.200.36.34.bc.googleusercontent.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=180, stale-if-error=180, stale-while-revalidate=180
access-control-expose-headers: X-Resolver
x-resolver: default
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/plain; charset=utf-8
vary: Origin

GET
H2 200 px.gif
ad-delivery.net/ 43 B
111 B 198ms
67ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=2
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2139976
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 94e5c6bd4bbfc338-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H3 200 favicon.ico
ad.doubleclick.net/ 1 KB
130 B 171ms
40ms Image
image/x-icon 142.250.31.148
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/favicon.ico?ad=300x250&ad_box_=1&adnet=1&showad=1&size=250x250

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.148 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bj-in-f148.1e100.net

Software

sffe /

Resource Hash

d961b08e4321250926de6f79087594975fe20ad1518de8f91eb711af5d1a6ef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
age: 968
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 13 Jun 2025 01:48:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 01:48:06 GMT
last-modified: Tue, 08 May 2012 13:08:06 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 104
x-xss-protection: 0
server: sffe

GET
H2 200 px.gif
ad-delivery.net/ 43 B
548 B 198ms
68ms Image
image/gif 2606:4700:10::ac43:b78
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ad-delivery.net/px.gif?ch=1&e=0.8955877378821757
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b78 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 5
access-control-expose-headers: *
x-goog-hash: crc32c=cpEfJQ==, md5=rUsPYG4PhGW8TEwXCzfhow==
cf-cache-status: HIT
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3"
age: 2139976
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 43
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: image/gif
last-modified: Wed, 05 May 2021 19:25:32 GMT
vary: Accept-Encoding
x-guploader-uploadid: AKDAyItT-otcqhYNDGgR2ZAToAFrNrHyd-WY0wked6k-yQuBHh_5VUT44s9oDJHbDMYdh9KQ60XTCvE
cache-control: public, max-age=86400
x-goog-storage-class: MULTI_REGIONAL
via: 1.1 google
cf-ray: 94e5c6bd4bc0c338-EWR
accept-ranges: bytes
access-control-allow-origin: *
x-goog-generation: 1620242732037093
content-length: 43
server: cloudflare

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 174ms
44ms XHR
application/javascript 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 3000
content-encoding: gzip
x-amz-version-id: r5.lR.LJ66XEXzxUUVo7iMemjL_F_GoE
etag: W/"a4d296427fc806b21335359e398c025c"
age: 10909
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: 2fp1ah_MpcprwfKGeY0ATTjmIdmK-PQjEhkM8c5U_TXGFkgyaT-lHQ==
date: Wed, 11 Jun 2025 23:02:26 GMT
content-type: application/javascript
vary: Origin,accept-encoding
last-modified: Thu, 29 Feb 2024 02:13:08 GMT
cache-control: public, max-age=86400
via: 1.1 e87e1498b0d1acb21c287e606097161a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 bd056b42-51db-43ce-9a8e-3b11319b5d1f Show response
config.aps.amazon-adsystem.com/configs/ 563 B
830 B 283ms
77ms Script
application/javascript 18.160.10.17
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.10.17 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-10-17.iad12.r.cloudfront.net
Software: CloudFront /
Resource Hash: 5f61913ef2f4b2742638b1f485e0177ef0d6673fecade0ff8b6dadc907dbd7c0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=3600
age: 1489
via: 1.1 7c77abdf1c625c25627fe2a24e660a34.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
content-length: 563
x-amz-cf-id: EUhvuxv9HwuB9Bgsu3-1wfNICPN4-P0BuUrxOnmtJfQSGLpRBGLjNg==
date: Thu, 12 Jun 2025 01:39:25 GMT
content-type: application/javascript
x-amz-cf-pop: IAD12-P3
server: CloudFront

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 4 KB
4 KB 32ms
31ms XHR
application/json 108.138.112.90
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fpaint.toys&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.112.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-112-90.jfk50.r.cloudfront.net
Software: Server /
Resource Hash: 843b1f9a354b48dac90a3287f0219d215a73fbad39fcaa1ef2f4e2ef272f6f2f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=21550, s-maxage=21600
age: 18129
access-control-allow-credentials: true
via: 1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Hit from cloudfront
content-length: 3591
x-amz-cf-id: 7d4A2csSdAn56P4OtC9iaMEPya1zHLKbqy_sSmvAc2G0vKUfuOAxdQ==
date: Wed, 11 Jun 2025 21:02:04 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: JFK50-P3
server: Server

GET b4382eff-6b9a-498b-9050-00c6f25451a1
https://paint.toys/ 0
0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 263ms
90ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 12 Jun 2025 02:04:14 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 266781
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 config.json Show response
config.playwire.com/audience_segments/ 330 KB
57 KB 259ms
60ms XHR
application/json 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://config.playwire.com/audience_segments/config.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c3c6a46c2f99fbed79f7f597da5cf808546f3ba1d6c703008536eb481b00a6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-max-age: 7200
access-control-expose-headers: hw-country-code
content-encoding: gzip
cf-cache-status: HIT
age: 71563
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Origin, Accept-Encoding
last-modified: Tue, 10 Jun 2025 12:38:25 GMT
priority: u=1,i
strict-transport-security: max-age=31536000; includeSubDomains
hw-country-code: US
cache-control: public, max-age=86400
cf-ray: 94e5c6be29485017-EWR
access-control-allow-origin: *
server: cloudflare

GET
H2 200 474.9e5e7d94b0ad365e11fa.js Show response
cdn.intergient.com/pageos/V.20250609.1/ 3 KB
1 KB 46ms
45ms Script
text/javascript 2606:4700::6812:1538
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.intergient.com/pageos/V.20250609.1/474.9e5e7d94b0ad365e11fa.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/runtime.7ab61523d24414456401.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1538 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f0769b6ec00799d55c116b89a5b71d923e5ea0d9f0d7e1fac3fe1914599e658

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

hw-country-code: US
content-encoding: br
cf-cache-status: HIT
etag: W/"f32f7966b1a24d5db4c7e8891271dc87"
age: 2911
cf-ray: 94e5c6bcf96a005e-EWR
alt-svc: h3=":443"; ma=86400
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 15:09:05 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 script Show response
carbon-cdn.ccgateway.net/ 37 KB
9 KB 261ms
44ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 6f2d54526ed125e84c618a2cf32bb28cb720a05738c5d8c93a4ef3f6536c9d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=900
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 450 KB
143 KB 258ms
78ms Script
text/javascript 2607:f8b0:4004:c1f::5f
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1f::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

175e01386feac273d9a88726685111e8c678f214288508e6c40b0ba3025db4d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 8719142973821815
x-content-type-options: nosniff
expires: Thu, 12 Jun 2025 02:04:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 145472
x-xss-protection: 0
server: cafe

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
659 B 733ms
230ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-52-5-253-69.compute-1.amazonaws.com

Software

Resource Hash

1526f7f540b829baf0e6d1b491aa7b26b5e49fa160abca67c11695ccfa2cee82

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 152 B
854 B 246ms
65ms Fetch
application/json 54.89.10.138
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17262
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.10.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-10-138.compute-1.amazonaws.com
Software: /
Resource Hash: ef0e999fdaa9f9314de8fc0f92b4b9bb57c9b8990d8e8b5c15abb70b883b4c2d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 152
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=utf-8

GET
H2 200 f Show response
fid.agkn.com/ 151 B
681 B 271ms
95ms Fetch
application/javascript 44.195.224.25
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.195.224.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-195-224-25.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: ce355d3822a71974bd1d104e77476c55c62ed107d39300146e83d1d21f108d13

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 151
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 2 KB
2 KB 225ms
51ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 865b55affa890c1e88763bc6269d59c02e18d30717d4dd649407956de65a9ad6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1552
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 339 B
751 B 241ms
68ms Fetch
text/plain 52.5.253.69
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.5.253.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

742f7f9cf3b240ccfc69aff171c811b1fefd54aaec45fee72370d3218499d2bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: max-age=86399, private
trace-id: 0355566d633c3aab
request-time: 3
access-control-allow-credentials: true
expires: Fri, 13 Jun 2025 02:04:14 GMT
access-control-allow-origin: https://paint.toys
content-length: 339
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=20fZqnxvUjFtbXN0ZGdSWWU2eSs3bjYyc2RkZk1LcklBYzd2RVBua3JIeGptR1c3OWdFZm9DTkgvMk9taUhQY3pWNzJYcFp5b0xSZkN3NnRubEZnZXQwRjBrSkpXZXBSdXB4U3BadXpCZDNjaE5XTHpHd2tSdkphRHdRL1...

360 B
924 B

183ms
85ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=20fZqnxvUjFtbXN0ZGdSWWU2eSs3bjYyc2RkZk1LcklBYzd2RVBua3JIeGptR1c3OWdFZm9DTkgvMk9taUhQY3pWNzJYcFp5b0xSZkN3NnRubEZnZXQwRjBrSkpXZXBSdXB4U3BadXpCZDNjaE5XTHpHd2tSdkphRHdRL1VVTjFOVzQ5WFBYd1F1TE5BSmwwNSt5QkcvTWtJZWFoQ0JFMFJLWWJNSk5Zcy9QdnA1VldvbjhKUThnWENjZWtJZTdxTUYrNjZoeUhLL1UzVDUrSWxsWTRXZDJBdjlDUkxIc1pTVkJuVklxMTBjZWhTMS9wankzdWhGUnRTdEVkUzdLeWFFZCtrfA&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

654edba7677aabe114b840928f075e28b594fa6f248cad625fc067c75c3a9d88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 492857
expires: 0
access-control-allow-origin: null
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=20fZqnxvUjFtbXN0ZGdSWWU2eSs3bjYyc2RkZk1LcklBYzd2RVBua3JIeGptR1c3OWdFZm9DTkgvMk9taUhQY3pWNzJYcFp5b0xSZkN3NnRubEZnZXQwRjBrSkpXZXBSdXB4U3BadXpCZDNjaE5XTHpHd2tSdkphRHdRL1VVTjFOVzQ5WFBYd1F1TE5BSmwwNSt5QkcvTWtJZWFoQ0JFMFJLWWJNSk5Zcy9QdnA1VldvbjhKUThnWENjZWtJZTdxTUYrNjZoeUhLL1UzVDUrSWxsWTRXZDJBdjlDUkxIc1pTVkJuVklxMTBjZWhTMS9wankzdWhGUnRTdEVkUzdLeWFFZCtrfA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 269536
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 12 Jun 2025 02:04:13 GMT
server: Kestrel

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 25 B
374 B 650ms
289ms Fetch
application/json 18.165.93.212
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpaint.toys%2Foil%2F&pr=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&pid=mZQrI8VxaMlzp&cb=0&ws=1600x1200&v=25.606.1714&t=2500&slots=%5B%7B%22sd%22%3A%22pw-160x600_atf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22pw-160x600_btf%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600%22%7D%2C%7B%22sd%22%3A%22leaderboard_atf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%2C%7B%22sd%22%3A%22leaderboard_btf%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-desktop_leaderboard%22%7D%5D&pj=%7B%22device%22%3A%7B%22sua%22%3A%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22mobile%22%3A0%2C%22model%22%3A%22%22%2C%22source%22%3A2%2C%22platform%22%3A%7B%22brand%22%3A%22%22%2C%22version%22%3A%5B%22%22%5D%7D%2C%22browsers%22%3A%5B%5D%7D%7D%7D&sg=%7B%22ortb2%22%3A%7B%22site%22%3A%7B%22cattax%22%3A6%2C%22cat%22%3A%5B%22693%22%5D%2C%22sectioncat%22%3A%5B%22693%22%5D%2C%22pagecat%22%3A%5B%22693%22%5D%7D%7D%7D&schain=1.0%2C1%21playwire.com%2C1024872%2C1%2C%2C%2C&sm=96f79531-6751-45f9-94ab-e599cbae595b&pubid=bd056b42-51db-43ce-9a8e-3b11319b5d1f&gdprl=%7B%22status%22%3A%22no-cmp%22%7D&rt=j
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.165.93.212 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-165-93-212.iad55.r.cloudfront.net
Software: Server /
Resource Hash: 7dc78c5c119373b361b76d7e9c1b2759725163789661df908ee4cd8faf842676

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 4f3476fc0ed69f4f9209b2ccb91b0050.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 45
x-amz-cf-id: DJ8N32Oohb70c5hc6_oZMa144WpY2wbBdQq7u4BDsHsXdUGY58RHIw==
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=UTF-8
x-amz-cf-pop: IAD55-P4
server: Server

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 353ms
42ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "d734-5f2f3919e751f-gzip"
expires: Thu, 12 Jun 2025 02:19:14 GMT
accept-ranges: bytes
content-length: 17407
date: Thu, 12 Jun 2025 02:04:14 GMT
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 43 KB
13 KB 51ms
48ms Script
text/javascript 3.167.69.77
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.167.69.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-167-69-77.iad61.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fd7fc4b8be9c2eeb3efb728f0483d444e4a8db80f0597e4ef7950105638bb08

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

vary: Accept-Encoding
cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"ad78eaf46246cac6849005eb8b50ae6f"
age: 64528
via: 1.1 c8e5a51ce52caf510dff11d206de43ac.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: qrceJnM3OI0XpMpQGUyYTvBrmVM7fXL7pku1ZZJr6b0MOi4K8zHUog==
date: Wed, 11 Jun 2025 08:08:47 GMT
content-type: text/javascript
last-modified: Tue, 20 Aug 2024 18:47:23 GMT
server: AmazonS3
x-amz-cf-pop: IAD61-P6
x-amz-server-side-encryption: AES256

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 58 KB
13 KB 349ms
53ms Script
text/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&_it=amazon&partner_id=403
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f8fc7b65c78d42b3f74d3bcd0c4457de39becd0b510a78e7cbd4315ca641e389

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=432000
content-encoding: br
cf-cache-status: HIT
etag: W/"b0d172903a4e7356d3c5f52cc45d679c"
age: 980
x-amz-request-id: 30EKW3CXSWT5N57D
expires: Tue, 17 Jun 2025 02:04:14 GMT
cf-ray: 94e5c6bf9edfefa1-EWR
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript
last-modified: Thu, 13 Mar 2025 11:48:41 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: 4RIrFaaxfD+TDcC6uYxWpX9IaghtYatCwZOUwila/c0bkzhiT5xDAXkdzqEBgOl600iRD9MSwqA=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 105 KB
31 KB 362ms
54ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4aa9663a2b7e8a95f696797d2de73d14d8f253667d17dd271a92c7f7f0657d30

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: HIT
etag: W/"9d570924a86a2d266b00dbcf6b3f35f4"
age: 8
expires: Thu, 12 Jun 2025 03:04:14 GMT
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript;charset=utf-8
last-modified: Thu, 29 May 2025 12:42:30 GMT
vary: Accept-Encoding
x-amz-id-2: vlO7drURjSbnFPFl23pNiF/EXA4B0qUHVGLN1GKw3+M9qe+ykQW6jmIMZysZ4e6Ksp5N/lAr5gc=
strict-transport-security: max-age=15552000; includeSubDomains; preload
cache-control: public, max-age=3600
x-amz-request-id: 95SSYFAGGKHRCYWN
cf-ray: 94e5c6bfaf800f3b-EWR
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 launcher-stub.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 14 KB
5 KB 363ms
55ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d3c286558922ca8c2c69167698cd61a8280cb03b81bb41d9bd633f80f18c274f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "38c0-5e92054540ea5-gzip"
expires: Thu, 12 Jun 2025 02:19:14 GMT
accept-ranges: bytes
content-length: 5252
date: Thu, 12 Jun 2025 02:04:14 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

db_sync
px.ads.linkedin.com/
Redirect Chain

https://idsync.rlcdn.com/712453.gif?partner_uid=user_fc4707c4-37af-492b-a8b0-af5ab1d7ad7a_1749693854200
https://idsync.rlcdn.com/1000.gif?memo=CIW-KxJDCj8IARDptAoaN3VzZXJfZmM0NzA3YzQtMzdhZi00OTJiLWE4YjAtYWY1YWIxZDdhZDdhXzE3NDk2OTM4NTQyMDAQABoNCJ7rqMIGEgUI6AcQAEIASgA
https://pippio.com/api/sync?pid=5324&it=1&iv=345e4590ae4fb35a65451f8ebc716c68c76d9a96cab4fa4adc9b4f9f3703b6cc791426b5417dce21&_=2
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=345e4590ae4fb35a65451f8ebc716c68c76d9a96cab4fa4adc9b4f9f3703b6cc791426b5417dce21&rand=06951615
https://px.ads.linkedin.com/db_sync?pid=10339&puuid=345e4590ae4fb35a65451f8ebc716c68c76d9a96cab4fa4adc9b4f9f3703b6cc791426b5417dce21&rand=06951615&expected_cookie=c713ddbd-3027-499c-8cb1-79eab2fc22e9

0
143 B

49ms
48ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/db_sync?pid=10339&puuid=345e4590ae4fb35a65451f8ebc716c68c76d9a96cab4fa4adc9b4f9f3703b6cc791426b5417dce21&rand=06951615&expected_cookie=c713ddbd-3027-499c-8cb1-79eab2fc22e9
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D8AAD6877B814B118BACD7265814C558 Ref B: PHL30EDGE0213 Ref C: 2025-06-12T02:04:15Z
x-li-fabric: prod-lva1
x-li-uuid: AAY3Vli303A8+DCZxHeY/g==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT

Redirect headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
location: /db_sync?pid=10339&puuid=345e4590ae4fb35a65451f8ebc716c68c76d9a96cab4fa4adc9b4f9f3703b6cc791426b5417dce21&rand=06951615&expected_cookie=c713ddbd-3027-499c-8cb1-79eab2fc22e9
x-msedge-ref: Ref A: 771F75E1541D48348B476E3F6548C8E6 Ref B: PHL30EDGE0213 Ref C: 2025-06-12T02:04:15Z
x-li-fabric: prod-lva1
x-li-uuid: AAY3Vli2fvd4GOl3SAzL/Q==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT

GET
H/1.1

200
OK

/ Show response
ps.eyeota.net/pixel/bounce/
Redirect Chain

https://ps.eyeota.net/pixel?pid=m51mh00&t=ajs&uid=user_fc4707c4-37af-492b-a8b0-af5ab1d7ad7a_1749693854200
https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fc4707c4-37af-492b-a8b0-af5ab1d7ad7a_1749693854200

1 KB
2 KB

36ms
36ms

Script
application/javascript

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://ps.eyeota.net/pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fc4707c4-37af-492b-a8b0-af5ab1d7ad7a_1749693854200
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: 366de8fb21f67c3f51c280faf00ea0d4ab1559b5f1b0daf0108986f2a656680a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 1247
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:14 GMT
Content-Type: application/javascript

Redirect headers

Location: /pixel/bounce/?pid=m51mh00&t=ajs&uid=user_fc4707c4-37af-492b-a8b0-af5ab1d7ad7a_1749693854200
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:14 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 115 B
444 B 218ms
99ms XHR
application/json 54.89.10.138
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/17138/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.10.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-10-138.compute-1.amazonaws.com
Software: /
Resource Hash: cf5dcca6e373b291a6128af9759b6478858939bd790952614554a1969f4e5993

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 115
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=utf-8

GET
H2 200 topics_frame.html Show response
ads.pubmatic.com/AdServer/js/topics/ Frame 58A4 2 KB
1 KB 372ms
86ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/topics/topics_frame.html?bidder=pubmatic
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c16a536e9381a97c5d473a2b70aa9057bceebe38f05bb7d90360c96bff579033

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=54795
content-encoding: gzip
content-length: 859
content-type: text/html
date: Thu, 12 Jun 2025 02:04:14 GMT
expires: Thu, 12 Jun 2025 17:17:29 GMT
last-modified: Tue, 21 Mar 2023 05:02:13 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 topics_frame.html Show response
pa.openx.net/ Frame C553 1 KB
2 KB 409ms
42ms Document
text/html 34.36.214.49
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://pa.openx.net/topics_frame.html?bidder=openx
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.36.214.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 49.214.36.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e821663dddb56fb07c8670392dd396621a47e7816534ba539c02694a115f9254

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2211
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-length: 1036
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 01:27:23 GMT
etag: "c5379e35e267deacc52e06ed0f5fa81f"
last-modified: Mon, 22 Jan 2024 14:38:43 GMT
server: UploadServer
supports-loading-mode: fenced-frame
vary: Origin
x-allow-fledge: true
x-goog-generation: 1705934323795552
x-goog-hash: crc32c=eLLIGA== md5=xTeeNeJn3qzFLgbtD1+oHw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1036
x-guploader-uploadid: ABgVH8-16F8EMcUKZ92buppO6GNVh3MrmdhuZZ6XIgDu08QiBj6pcpzV4FAj79KLYhTAtzmQ

POST
H3 200 cookie_sync Show response
prebid.intergient.com/ 2 KB
1 KB 308ms
49ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/cookie_sync
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 21d19d70c19d99e39cc1d2a0fde5b6d2bab157eb1ed253c8c2cc4cf20e7d7c29

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1749693854&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=LI8exMmYJipNrFkPmVjdB0SNe2XNX9qwzkeOVot3vpM%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json; charset=utf-8
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1749693854&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=LI8exMmYJipNrFkPmVjdB0SNe2XNX9qwzkeOVot3vpM%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 94e5c6bf9d210ee6-EWR
access-control-allow-origin: https://paint.toys
server: cloudflare

POST
H3 200 auction Show response
prebid.intergient.com/openrtb2/ 95 KB
21 KB 783ms
551ms Fetch
application/json 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 509e6d61b577e4b70a858b86ae726d1d27a191bbb0d43b636748391d45d9a6c6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1749693854&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=LI8exMmYJipNrFkPmVjdB0SNe2XNX9qwzkeOVot3vpM%3D"}]}
observe-browsing-topics: ?1
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: Origin
priority: u=1,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1749693854&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=LI8exMmYJipNrFkPmVjdB0SNe2XNX9qwzkeOVot3vpM%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 vegur
cf-ray: 94e5c6bf9d250ee6-EWR
access-control-allow-origin: https://paint.toys
x-prebid: pbs-go/unknown
server: cloudflare

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
1 KB 415ms
48ms Fetch
application/json 54.158.18.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=9.43.0&referrer=https%3A%2F%2Fpaint.toys%2Foil%2F&tmax=2500&fledge=true

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.158.18.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-158-18-149.compute-1.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
accept-ch: sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile
access-control-allow-credentials: true
expires: Thu, 15 Oct 1992 20:10:00 GMT
access-control-allow-origin: https://paint.toys
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 16 KB
8 KB 600ms
237ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=f600987c-dab2-4d88-bbbd-f09e42439105%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=9a34aee1-54fc-474d-bb28-7331b85e0350%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_atf&tg_i.pbadslot=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a2a823bd-6835-4350-9aa5-8d40b062d315&l_pb_bid_id=68ef0e50865f9be8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=d5fe25c7-4031-4727-a010-e2edd9246318&p_site.mobile=0&rp_maxbids=1&p_gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&m_ch_mobile=%3F0&slots=1&rand=0.3902119017173852
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 091854aa3944ad361baf1c6393b4f4329cab9a92a06234d9519edf936f8a72da

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 16 KB
8 KB 502ms
142ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=9&alt_size_ids=8&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=f600987c-dab2-4d88-bbbd-f09e42439105%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=9a34aee1-54fc-474d-bb28-7331b85e0350%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=pw-160x600_btf&tg_i.pbadslot=pw-160x600_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a2a823bd-6835-4350-9aa5-8d40b062d315&l_pb_bid_id=69727b5f493778d8&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=cf20b627-cb37-4687-885d-532936f096d2&p_site.mobile=0&rp_maxbids=1&p_gpid=pw-160x600_btf&m_ch_mobile=%3F0&slots=1&rand=0.9785882123978846
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: d47da25ac34919678245b51e4e9aa38d61e725a8db076bf15d32ac581f0541b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 542 B
1 KB 409ms
50ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&p_pos=atf&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=f600987c-dab2-4d88-bbbd-f09e42439105%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=9a34aee1-54fc-474d-bb28-7331b85e0350%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=atf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_atf&tg_i.pbadslot=leaderboard_atf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a2a823bd-6835-4350-9aa5-8d40b062d315&l_pb_bid_id=703a10014eca8048&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=b0b2cc9d-a609-40fd-904a-8fa01443985c&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_atf&m_ch_mobile=%3F0&slots=1&rand=0.9885991087443584
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: a5506dd02f83cb6a310c4f47ead42ca603411bb18cce3ffceace92a47ddc6902

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 542
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 542 B
905 B 420ms
61ms Fetch
application/json 2602:803:c002:200::32
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=12556&site_id=110932&zone_id=523774&size_id=2&alt_size_ids=55%2C57&rp_schain=1.0,1!playwire.com,1024872,1,,,&eid_pubcid.org=f600987c-dab2-4d88-bbbd-f09e42439105%5E1%5E%5E%5E%5E%5E&eid_linkedin.com=9a34aee1-54fc-474d-bb28-7331b85e0350%5E1%5E%5E%5E%5E%5E&rf=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.domain=paint.toys&tg_i.page=https%3A%2F%2Fpaint.toys%2Foil%2F&tg_i.ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&tg_i.cat=IAB9-5%2C693&tg_i.sectioncat=IAB9-5%2C693&tg_i.pagecat=IAB9-5%2C693&tg_i.mobile=0&tg_i.pos=btf&tg_i.sitecont_cat=games_casual&tg_i.adunit=leaderboard_btf&tg_i.pbadslot=leaderboard_btf&tk_flint=pbjs_lite_v9.43.0&x_source.tid=a2a823bd-6835-4350-9aa5-8d40b062d315&l_pb_bid_id=71ffa2496f9266a&p_screen_res=1600x1200&o_ae=1&rp_secure=1&x_imp.ext.tid=36788389-b940-4e66-b680-55a0b9b947b5&p_site.mobile=0&rp_maxbids=1&p_gpid=leaderboard_btf&m_ch_mobile=%3F0&slots=1&rand=0.9729692929042035
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c002:200::32 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.27.2 /
Resource Hash: 2085a407809d425fb6a20b95a5d3a1717c819577511909a3f1904bdd01f5ed89

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT
access-control-allow-origin: https://paint.toys
content-length: 542
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Accept-Encoding
server: nginx/1.27.2

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
703 B 1039ms
715ms Fetch 137.184.242.70
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.242.70 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 12 Jun 2025 02:04:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
955 B 613ms
287ms Fetch 137.184.242.70
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.242.70 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 12 Jun 2025 02:04:14 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 204 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 0
685 B 867ms
542ms Fetch 137.184.242.70
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.242.70 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control
access-control-allow-origin: https://paint.toys
cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
date: Thu, 12 Jun 2025 02:04:15 GMT
vary: Accept-Encoding
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

POST
H2 200 665db4754b2ec067196b8f78 Show response
exchange.cootlogix.com/prebid/multi/ 47 KB
22 KB 797ms
472ms Fetch
application/json 137.184.242.70
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://exchange.cootlogix.com/prebid/multi/665db4754b2ec067196b8f78
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 137.184.242.70 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: afdd5b42354eebce86d834906bbaa145f4845b0eb6a467dccf717a2c5a5b1d72

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=0, no-cache, must-revalidate, proxy-revalidate
content-encoding: gzip
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, Content-Range, Cache-Control

POST
H2 400 auction Show response
elb.the-ozone-project.com/openrtb2/ 236 B
482 B 460ms
97ms Fetch
text/plain 104.18.34.190
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://elb.the-ozone-project.com/openrtb2/auction
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.34.190 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6589f704aea9fcfe5d5fb76ec2827b5aeaa1b91d8e541f0c35a2b3de58a57983

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
pragma: no-cache
access-control-allow-credentials: true
via: 1.1 google
cf-ray: 94e5c6c0780341a6-EWR
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 236
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/plain; charset=utf-8
vary: Origin, Accept-Encoding
server: cloudflare

POST
H3 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
673 B 293ms
54ms Fetch
application/json 104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=1031634
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f14353f2b081d913bd708e6d854a2bd32f40297022727555a33d2ab506cdc54

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MP5SveEPiT5bCTmLLhtzM0s%2BXsoIC8elvw9hPkP3UWK%2FeIyMFy6H2Tq2sakZZWJEjKrko%2Bm3nd3gB5%2Fthk%2BOFxwvUM6auFQaoJhucxmqZtm85%2Fmra%2FoC0ZRsBHtW2TZTIKjawvt2"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Accept-Encoding
priority: u=1,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
access-control-allow-credentials: true
cf-ray: 94e5c6bfbc003869-EWR
access-control-allow-origin: https://paint.toys
content-length: 37
server: cloudflare

POST
H2 200 hb-multi Show response
hb.yellowblue.io/ 83 B
620 B 375ms
51ms Fetch
application/json 3.168.102.9
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://hb.yellowblue.io/hb-multi
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.168.102.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-168-102-9.jfk52.r.cloudfront.net
Software: istio-envoy /
Resource Hash: 9cf31456c0751475601213f723be705a54f0bf6b90d99e0679cfa797f94af1dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
via: 1.1 1b4fcdcf534aed5a7a4dae6e1d54fc52.cloudfront.net (CloudFront)
access-control-allow-origin: https://paint.toys
x-cache: Miss from cloudfront
content-length: 108
x-amz-cf-id: b-DLd6b3p64JvSOIgS4Noc5B5X-hGlveUMFHurUkpQGyDXd-MJleTw==
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P6
server: istio-envoy
x-reason: maxmind anonymous
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

POST
H/1.1 200
OK playwire Show response
direct.adsrvr.org/bid/bidder/ 0
414 B 379ms
47ms Fetch
application/json 199.250.169.129
TTD-ASN-01

General

Check archive.org

Download Go to

Full URL: https://direct.adsrvr.org/bid/bidder/playwire
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.250.169.129 , United States, ASN26459 (TTD-ASN-01, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

x-openrtb-version: 2.3
cache-control: private
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
server: Kestrel
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type

POST
H2 204 request Show response
grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/ 0
460 B 591ms
231ms Fetch 2620:100:a00b::c
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid-bidder.criteo.com/openrtb_2_5/pbjs/auction/request?profileId=207&av=37&wv=9.43.0&cb=76508531467&lsavail=1&networkId=6163

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::c , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:14 GMT
vary: Origin
server: Kestrel
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 398ms
87ms Fetch 3.238.251.167
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.238.251.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 399ms
88ms Fetch 3.238.251.167
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.238.251.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
117 B 401ms
90ms Fetch 3.238.251.167
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.238.251.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
116 B 396ms
86ms Fetch 3.238.251.167
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.238.251.167 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
access-control-allow-origin: https://paint.toys
access-control-allow-credentials: true

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
360 B 487ms
176ms Fetch
text/plain 35.186.253.211
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 201e1446b0e737726bf894a0f22f84cd48cc8cf289a84f65591a13cb34b6eae2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-forwarded-for: 206.66.99.143
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 12 Jun 2025 02:04:13 GMT
content-type: text/plain
vary: Origin

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 34 KB
15 KB 579ms
271ms Fetch
application/json 2620:100:a00b::5
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://grid.bidswitch.net/hbjson

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::5 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4ffd311b0c7f441667ab99e2058a55836419c36b1eaffa393942a90d62339f73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store, must-revalidate, no-cache
content-encoding: br
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Accept-Encoding, Origin
server: Kestrel

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 473 B
1 KB 384ms
33ms Fetch
application/json 68.67.181.103
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

772f6f86fea8c43b7f040d385793520ac9fa8f301b815884477bba8353dfe189

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.143; 206.66.99.143; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://paint.toys
an-x-request-uuid: fe4d0ad6-dbb4-4d68-9d3f-0120ff586b88
content-length: 473
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:14 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
server: nginx/1.23.4

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 385ms
86ms Fetch
application/json 34.198.127.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1749693854434&to=600&aun=pw-160x600_atf&pubcid=f600987c-dab2-4d88-bbbd-f09e42439105&gpid=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=d5fe25c7-4031-4727-a010-e2edd9246318&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.127.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-127-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
243 B 383ms
85ms Fetch
application/json 34.198.127.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1749693854435&to=600&aun=pw-160x600_btf&pubcid=f600987c-dab2-4d88-bbbd-f09e42439105&gpid=pw-160x600_btf&t=8ylgv2wd&pi=3&maxw=160&maxh=600&si=1111716&bf=160x600%2C120x600&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=cf20b627-cb37-4687-885d-532936f096d2&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.127.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-127-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 383ms
85ms Fetch
application/json 34.198.127.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1749693854435&to=600&aun=leaderboard_atf&pubcid=f600987c-dab2-4d88-bbbd-f09e42439105&gpid=leaderboard_atf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=b0b2cc9d-a609-40fd-904a-8fa01443985c&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.127.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-127-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 2 B
242 B 389ms
92ms Fetch
application/json 34.198.127.229
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?displaymanager=Prebid.js%20-%20gumgum&displaymanagerver=9.43.0&lt=1749693854435&to=600&aun=leaderboard_btf&pubcid=f600987c-dab2-4d88-bbbd-f09e42439105&gpid=leaderboard_btf&t=8ylgv2wd&pi=3&maxw=970&maxh=250&si=1111709&bf=728x90%2C970x250%2C970x90&ae=true&schain=1.0%2C1!playwire.com%2C1024872%2C1%2C%2C%2C&tId=36788389-b940-4e66-b680-55a0b9b947b5&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&tpl=https%3A%2F%2Fpaint.toys%2Foil%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%2C%22pbv%22%3A%229.43.0%22%7D&ogu=null&ns=10240&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&dnt=0&lang=en
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.198.127.229 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-198-127-229.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 2
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=UTF-8
server: nginx

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
277 B 497ms
189ms Fetch 207.65.37.179
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.179 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate, no-store, no-cache, private
access-control-allow-credentials: true
observe-browsing-topics: ?1
pmfcgi-resp: TRUE
access-control-allow-origin: https://paint.toys
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:14 GMT
server: nginx

GET
H2 200 trustedIframe.html Show response
btloader.com/ Frame 37B2 1 KB
924 B 221ms
110ms Document
text/html 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:293c -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cf20553d87717214f494bab7a4c363a6b6c08edfdc944b79c02c55d2153a2333

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cf-cache-status: DYNAMIC
cf-ray: 94e5c6bf29e98c41-EWR
content-encoding: br
content-type: text/html
date: Thu, 12 Jun 2025 02:04:14 GMT
server: cloudflare
server-timing: cfCacheStatus;desc="DYNAMIC" cfOrigin;dur=29,cfEdge;dur=12
vary: Origin
via: 1.1 google

GET
H2 200 country Show response
api.btloader.com/ 37 B
153 B 408ms
120ms Fetch
application/json 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/country?o=5150306120761344
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash: b8f0ca68362cf245f891fc09ddfa50806d195e78e196cf96ac5d9cf72be2577a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private, max-age=300, stale-while-revalidate=600, stale-if-error=600
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Origin

POST
H2 204 pv
api.btloader.com/ 0
0 403ms
119ms Fetch 130.211.23.194
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://api.btloader.com/pv?nlf=false&tid=AXjz2lM6U-Si3DYti0-9761e171aa&sid=tpCw6Lky5-t0ObDOAq-9761e171aa&cv=2.1.114&upapi=true
Requested by: Host: btloader.com
URL: https://btloader.com/tag?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.23.194 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 194.23.211.130.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:14 GMT
vary: Origin

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 235 B
564 B 104ms
100ms XHR
application/json 54.89.10.138
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.89.10.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-89-10-138.compute-1.amazonaws.com
Software: /
Resource Hash: af79a5e1bf46dea119909ae8e71f85d06d6aae49b2d825c82922555bea4220ab

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://paint.toys
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 235
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json;charset=utf-8

GET
H2 200 AGSKWxXa8LgUujdJas8EWLtdT1RtiqewRKZgRJGERs0miyc836LyDktLK79uK74-mpf5lYtrhivH6kHarLFnGdIeZNcT4V2lqk41SoveLI4on1eMjpD1yirZGYtZMT4egPgyhiPxG5A8tg== Show response
fundingchoicesmessages.google.com/f/ 2 KB
2 KB 75ms
71ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXa8LgUujdJas8EWLtdT1RtiqewRKZgRJGERs0miyc836LyDktLK79uK74-mpf5lYtrhivH6kHarLFnGdIeZNcT4V2lqk41SoveLI4on1eMjpD1yirZGYtZMT4egPgyhiPxG5A8tg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ5NjkzODU0LDUyNTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJrMTZ0VWpGQnB0cyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxc3hjZC52ZXJvbmljYWJhemFuLmNsIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.k16tUjFBpts.es5.O/d=1/rs=AJlcJMymRDfA7NO0Ubpc6qHktPYvwwefRQ/m=kernel_loader,loader_js_executable

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5db63b164f5ba2ca8895954f83f02f65289878e80ce26027de3577fd6e2429bc

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-rx_SJuk390WLLBPCCdwhRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1pBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8S7Nt5iPQzEZn63We2AuHD6bdZKIBbi4Zj3esUhNoEJV7ZNZFLSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAzsNQzMIovMAAA7M09Dw"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-rx_SJuk390WLLBPCCdwhRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame FB52 102 KB
28 KB 163ms
37ms Document
text/html 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f45d61497e37e41e0887cd3ee260b5153f7898ec8760c5462c8a97f455927c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 845
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29139
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Jun 2025 01:50:09 GMT
expires: Thu, 12 Jun 2025 02:40:09 GMT
last-modified: Mon, 09 Jun 2025 19:43:33 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 306ms
41ms Script
application/javascript 2600:9000:24f1:1000:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:24f1:1000:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

56351c084d8d56437d41f1e58b7eb184b563871e88bab60f6b15486c39f13996

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: "faa388a163b1b6d0377ee77a861591e5"
age: 518
x-cache: Hit from cloudfront
x-amz-cf-id: ol5O6VNjgoTYfUoWtnAdbcfRgfD58U-id9wyURXBkK1EaQUnZSVeAA==
date: Thu, 12 Jun 2025 01:55:37 GMT
content-type: application/javascript
last-modified: Mon, 22 Apr 2024 18:18:45 GMT
x-amz-expiration: expiry-date="Mon, 23 Apr 2029 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
content-security-policy: default-src 'self'
cache-control: max-age=3600
via: 1.1 2041b05ebafba84de0e785871a4269bc.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 8729
x-amz-cf-pop: JFK50-P4
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 315ms
51ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-goog-metageneration: 1
content-encoding: gzip
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
etag: "df5542b88bc0e368c6999754a5b9e2ba"
age: 2097473
x-goog-stored-content-encoding: gzip
expires: Mon, 18 May 2026 19:26:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 7927
date: Sun, 18 May 2025 19:26:21 GMT
last-modified: Thu, 27 May 2021 18:30:51 GMT
content-type: application/javascript
x-guploader-uploadid: AAO2VwrMSjzJE335hEA4T0AEiYoZ3weO_vixNiBlNOgSOyxCypufToQPyQsX0tKeyunr7Lx5LHgtJ8Q
cache-control: no-transform
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1622140251693895
content-length: 7927
server: UploadServer

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 3 KB
3 KB 424ms
161ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 2e5f5cb912c0619933ea6c3ad8ac1466a005f792e3338d96a8432d144c63520f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

etag: 861bdaf24bda5c0db45c6ebe1c94a9eb
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2729
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
last-modified: Wed, 05 Feb 2025 14:45:21 GMT
server: Google Frontend
x-cloud-trace-context: f76711fd961ddd307e3556f59855789c

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 17 KB
7 KB 279ms
47ms Script
application/javascript 104.18.29.101
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.29.101 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 72223c20f8ad08445b32a2b4843a0f04fe33cee40811ade04b21598cf67fbea3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public, max-age=259200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"678fc4ec-4599"
age: 270043
cf-ray: 94e5c6c08b7db637-EWR
expires: Sun, 15 Jun 2025 02:04:14 GMT
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/javascript
last-modified: Tue, 21 Jan 2025 16:01:48 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 229ms
45ms Script
text/javascript 2620:100:a00b::30
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::30 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8b9649ecf99400f7fefce2ec3568d60386481da0991d4cb519b901aa4aca6c3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: max-age=86400, public
timing-allow-origin: *
content-encoding: gzip
etag: W/"67ece34f-a612"
cross-origin-resource-policy: cross-origin
expires: Fri, 13 Jun 2025 02:04:14 GMT
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript
last-modified: Wed, 02 Apr 2025 07:12:15 GMT
server: nginx

GET
H2 200 location Show response
privacy-location-edge.ccgateway.net/privacy/ 5 B
191 B 326ms
84ms XHR
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://privacy-location-edge.ccgateway.net/privacy/location
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 1c55d9b826e8dfa994370e306ae8dc2e849f3e003381dc848a0b95f782c0c0e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/plain; charset=utf-8
vary: Accept-Encoding
access-control-allow-credentials: true

GET
H2 200 classification Show response
pogo.ccgateway.net/v1/p/5bb3e20859/ 369 B
413 B 326ms
85ms XHR
application/json 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pogo.ccgateway.net/v1/p/5bb3e20859/classification?url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 825667f50bad732abf76eb8738e02389b4fb7676cf7e7c5411af38119c99a89f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: Origin, Accept-Encoding
access-control-allow-credentials: true

POST
H3 200 m1egnxf6r4dubywu6h5teq0_sh Show response
faucetfoot.com/ 295 B
319 B 170ms
67ms Fetch
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/m1egnxf6r4dubywu6h5teq0_sh

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/build/rhtp14sqsfk3

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1849279123 /

Resource Hash

0be1333ca8ea22ca47a3ae36c54010a6ae5154255496e4e3e229a6eafce4b658

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-spot-zzqg.gce-us-east1, 1.1 google
expires: Thu, 12 Jun 2025 02:04:13 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1849279123
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

GET
H2 200 AGSKWxXqZn9z88oInK407IQNIhFttLiRNujy3r6ah0OGjFQUMA3V36S1p2JAENdSQistQi5sktcp1Zn7Q20CHnaR3J9OHEN9yzGg1MqpQYlpt2ynM4PJx_ANnpriP9FecX6Pm_1pNFzygg== Show response
fundingchoicesmessages.google.com/f/ 9 KB
5 KB 73ms
73ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxXqZn9z88oInK407IQNIhFttLiRNujy3r6ah0OGjFQUMA3V36S1p2JAENdSQistQi5sktcp1Zn7Q20CHnaR3J9OHEN9yzGg1MqpQYlpt2ynM4PJx_ANnpriP9FecX6Pm_1pNFzygg==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ5NjkzODU0LDY0MDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vcGFpbnQudG95cy9vaWwvIixudWxsLFtbOCwiazE2dFVqRkJwdHMiXSxbOSwiZW4tVVMiXSxbMTksIjIiXSxbMTcsIlswXSJdLFsyNCwicXN4Y2QudmVyb25pY2FiYXphbi5jbCJdLFsyOSwiZmFsc2UiXV1d

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8857c1eff393186a2b995563e5c0ce53a8b8991745194ea2393322ea7e9cde49

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-H_nAbTUqyyjxWveKqLaryw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw0JBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8S7Nt5iPQzEZn63We2AuHD6bdZKIBbi4Zj3esUhNoEPbaeOMylpJOUXxifn55UUZSaVluQXpSWnpRanFpWlFsUbGRiZGpgZWOoZGMUXGAAAACg9cA"
content-security-policy: script-src 'report-sample' 'nonce-H_nAbTUqyyjxWveKqLaryw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 vcd15cbe7772f49c399c6a5babf22c1241717689176015 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame 37B2 19 KB
7 KB 218ms
49ms Script
text/javascript 2606:4700::6810:4f49
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015
Requested by: Host: btloader.com
URL: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:4f49 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Origin: https://btloader.com
Referer: https://btloader.com/

Response headers

cache-control: public, max-age=86400
content-encoding: gzip
etag: W/"2024.6.1"
cross-origin-resource-policy: cross-origin
cf-ray: 94e5c6c0fb514332-EWR
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Thu, 06 Jun 2024 15:52:56 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E122 20 KB
7 KB 56ms
52ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=91774
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 12 Jun 2025 02:04:14 GMT
expires: Fri, 13 Jun 2025 03:33:48 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 launcher.min.js Show response
secure.cdn.fastclick.net/js/cnvr-launcher/latest/ 49 KB
17 KB 73ms
72ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher-stub.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 938c64115ce60b98ee8151d7eb28208567753f3d4ebbe0aa0f56618c555a18fb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "c4b6-5e920545406d3-gzip"
expires: Thu, 12 Jun 2025 02:19:14 GMT
accept-ranges: bytes
content-length: 17042
date: Thu, 12 Jun 2025 02:04:14 GMT
last-modified: Tue, 20 Sep 2022 18:52:26 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 306ms
87ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 12 Jun 2025 02:04:14 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 231273
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

j Show response
rp4.liadm.com/
Redirect Chain

https://rp.liadm.com/j?dtstmp=1749693854753&did=did-0046&se=e30&duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsxcd.vero...
https://rp4.liadm.com/j?dtstmp=1749693854753&did=did-0046&se=e30&duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsxcd.ver...

13 B
369 B

346ms
45ms

Fetch
application/json

52.6.234.110
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://rp4.liadm.com/j?dtstmp=1749693854753&did=did-0046&se=e30&duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMxNDM6OjE0Mw%3D%3D
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 52.6.234.110 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-6-234-110.compute-1.amazonaws.com
Software: /
Resource Hash: efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

x-pixel-event-id: 12bdba5b-3b78-41c5-a6ef-9ebd81061017
access-control-max-age: 86400
access-control-expose-headers: *
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: null
content-length: 13
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json

Redirect headers

access-control-max-age: 86400
access-control-expose-headers: *
location: https://rp4.liadm.com/j?dtstmp=1749693854753&did=did-0046&se=e30&duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&tv=9.43.0&pu=https%3A%2F%2Fpaint.toys%2Foil%2F&wpn=prebid&refr=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&cd=.paint.toys&i6=MjYwMDo4MDM6YTg4OjMxNDM6OjE0Mw%3D%3D
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 12 Jun 2025 02:04:14 GMT

POST
H2 200 fb87a4ea41 Show response
cd836371f1d.cdn.intergient.com/ 0
96 B 239ms
52ms XHR
application/octet-stream 54.81.166.120
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cd836371f1d.cdn.intergient.com/fb87a4ea41
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/V.20250609.1/main.9fdb42b795b5a6edfd18.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.81.166.120 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-81-166-120.compute-1.amazonaws.com
Software: nginx/1.24.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/octet-stream
server: nginx/1.24.0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=eyeota&ttd_tpi=1&gdpr=0&gdpr_consent=
https://ps.eyeota.net/match?uid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&bid=1e2n4ou

70 B
440 B

68ms
36ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&bid=1e2n4ou
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:15 GMT
Content-Type: image/gif

Redirect headers

location: https://ps.eyeota.net/match?uid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&bid=1e2n4ou
content-length: 191
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MlRCZnVyMldOOVV5SlA2bGxwSkVIN0ZrcVdmLUp5bFdRQ0NBdC1SZHJ2REE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm=&google_sc=&google_hm=MlRCZnVyMldOOVV5SlA2bGxwSkVIN0ZrcVdmLUp5bFdRQ0NBdC1SZHJ2REE&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referr...
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPxyeqs_QNP1t2JQQ8898nw&google_cver=1

70 B
440 B

81ms
79ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPxyeqs_QNP1t2JQQ8898nw&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:15 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=m51mh00&google_gid=CAESEPxyeqs_QNP1t2JQQ8898nw&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 375
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/58773/cms?partner_id=Eyeot&gdpr=0&gdpr_consent=&verify=true
https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-lJHrmh1E2pXi.MsPVc9uQVODH13PXaZo87g-~A&gdpr=0

70 B
440 B

61ms
32ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-lJHrmh1E2pXi.MsPVc9uQVODH13PXaZo87g-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:15 GMT
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://ps.eyeota.net/match?bid=bhc9gd0&yahoo_ver=2&yahoo_id=y-lJHrmh1E2pXi.MsPVc9uQVODH13PXaZo87g-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html
server: ATS

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&referrer_pid=m51mh00
https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3463038936866790899&newuser=1&referrer_pid=m51mh00

70 B
440 B

35ms
34ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3463038936866790899&newuser=1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:15 GMT
Content-Type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=3463038936866790899&newuser=1&referrer_pid=m51mh00
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 12 Jun 2025 02:04:14 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24UID%26bid%3D2cr76e1%26referrer_pid%3Dm51mh00
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fps.eyeota.net%252Fmatch%253Fuid%253D%2524UID%2526bid%253D2cr76e1%2526referrer_pid%253Dm51mh00
https://ps.eyeota.net/match?uid=315100540158048298&bid=2cr76e1&referrer_pid=m51mh00

70 B
440 B

34ms
33ms

Image
image/gif

3.232.64.79
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=315100540158048298&bid=2cr76e1&referrer_pid=m51mh00
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 3.232.64.79 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-232-64-79.compute-1.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
Date: Thu, 12 Jun 2025 02:04:14 GMT
Content-Type: image/gif

Redirect headers

cache-control: no-store, no-cache, private
location: https://ps.eyeota.net/match?uid=315100540158048298&bid=2cr76e1&referrer_pid=m51mh00
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.143; 206.66.99.143; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 017c2d95-dacc-4e4d-9417-9974421238d1
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:14 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2 200 launcher Show response
proc.ad.cpe.dotomi.com/cvx/client/direct/ 190 B
459 B 258ms
85ms XHR
application/json 2606:ae80:1451:11::2100
CNVR-US-EAST

General

Check archive.org

Download Go to

Full URL: https://proc.ad.cpe.dotomi.com/cvx/client/direct/launcher?version=1.1.1&lid=681
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:ae80:1451:11::2100 , United States, ASN26762 (CNVR-US-EAST, US),
Reverse DNS
Software: nginx /
Resource Hash: 71f0c958e33905cb028dfd76ff7fcffa9d57a260845594e84d116530e3f80a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=1800
accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Bitness
access-control-allow-credentials: true
expires: Thu, 12 Jun 2025 02:34:14 GMT
access-control-allow-origin: https://paint.toys
content-length: 190
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json
vary: origin
server: nginx

GET
H2 200 403 Show response
a.ad.gt/api/v1/u/matches/ 9 KB
5 KB 199ms
53ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d29630d492397cc2a63f3b4c4ed5fdb863becf70a8d2a1625b19553edf43b4dd

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=7200
content-encoding: gzip
cf-cache-status: HIT
age: 2033
cross-origin-resource-policy: cross-origin
cf-ray: 94e5c6c1df481b58-EWR
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Thu, 12 Jun 2025 00:19:49 GMT

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 127 B
269 B 48ms
47ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&_it=amazon&partner_id=403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f29852f4f3ba4d33253735c04c5fb53bbf20921aade2bed532c0fc7910dbaa8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://paint.toys/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
access-control-allow-credentials: true
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
cf-ray: 94e5c6c2784dc62c-EWR
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
server: cloudflare
access-control-allow-headers: authorization,content-type

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 248ms
103ms Preflight
text/plain 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=403&sync=0&domain=paint.toys&url=https://paint.toys/oil/&v=06
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 94e5c6c1ddf6c62c-EWR
content-length: 0
content-type: text/plain
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: Fri, 12 Jun 2026 02:04:15 GMT
server: cloudflare

GET
H2 200 pbs-iframe Show response
pbs-cs.yellowblue.io/ Frame F791 5 KB
5 KB 350ms
45ms Document
text/html 54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: 4a61009d98f1bc8f3f6c4fd08d0d47a9baa986b0de580f770e64eb216cf98cd4

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://paint.toys/
access-control-expose-headers: X-Reason
content-type: text/html
date: Thu, 12 Jun 2025 02:04:15 GMT
server: istio-envoy
x-envoy-upstream-service-time: 2

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E122 2 KB
3 KB 151ms
34ms Script
text/html 207.65.37.181
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=4603038&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 207.65.37.181 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: ff2032989f06715f07301c0652c841067d5ef31db919596f2a8fadf5175b6948

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=UTF-8
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 userId Show response
script-api.ccgateway.net/1/ 446 B
705 B 55ms
39ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/1/userId
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 802dd31e79dbfa9bafdd8746ffc2c39dd3f3c767e80d22c7eef4e7227eba72e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=3156000
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 user.js Show response
script-api.ccgateway.net/script/launcher/2/ 2 KB
677 B 51ms
36ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/2/user.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: a11d3b4b6f2902037c365146ff80b5bf95923f3176f1a827355e45177314d423

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 customevents.js Show response
script-api.ccgateway.net/script/launcher/1/ 5 KB
2 KB 47ms
39ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/1/customevents.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 04c94ecaae50f713607dd45d40c5756d0e6a9e58c6398433ac098bc9bee89f5d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 api.js Show response
script-api.ccgateway.net/script/launcher/5/ 5 KB
2 KB 38ms
35ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/launcher/5/api.js
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: 67942c522b8f0e187f291d3dde230596fa526a323a9f50a0d667b6956839d98e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=604800
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

POST
H2 204 rum Show response
btloader.com/cdn-cgi/ Frame 37B2 0
173 B 40ms
38ms XHR
text/plain 2606:4700:10::ac43:293c
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://btloader.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:293c -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: application/json
Referer: https://btloader.com/trustedIframe.html?o=5150306120761344&upapi=true

Response headers

access-control-max-age: 86400
access-control-allow-credentials: true
access-control-allow-methods: POST,OPTIONS
x-content-type-options: nosniff
cf-ray: 94e5c6c15aeb8c41-EWR
access-control-allow-origin: https://btloader.com
date: Thu, 12 Jun 2025 02:04:14 GMT
vary: Origin
server: cloudflare
x-frame-options: DENY

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3799 16 KB
6 KB 158ms
48ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=paint.toys&gdpr=0&gdpr_consent=

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

41446a7078f22662b9d265e40764760dd615b13d704c6cdd9983991c94cfaf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 12 Jun 2025 02:04:14 GMT
server: Kestrel
server-processing-duration-in-ticks: 305240
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
282 B 592ms
251ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

Resource Hash

142b62bf4a205cf6a6e2d790315ad2b024636f0ee705d9407d338a6ac501acef

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 265 B
530 B 450ms
126ms Fetch
application/json 35.190.39.111
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 9f3bcab67ea895ae52448a957ab38866cf79644e974ea80936684400313152f2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: POST
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 265
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
x-cloud-trace-context: a1246cf4f0d0fd604186205be5120db5
server: Google Frontend
access-control-allow-headers: X-Requested-With

GET
H2 200 setUser Show response
script-api.ccgateway.net/ 0
360 B 35ms
34ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/setUser?parent=5bb3e20859&site=paint.toys&ccuid=83217f0e-fd5a-47d8-b8ca-e8db6f371db4&ccsid=e4298f86-5197-4f21-b4f1-bb5be8ec3d1a
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: private,max-age=300
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/javascript

GET
H2 200 bundle Show response
script-api.ccgateway.net/script/ 17 KB
5 KB 39ms
38ms Script
text/javascript 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://script-api.ccgateway.net/script/bundle?id=paint.toys&parentId=5bb3e20859
Requested by: Host: carbon-cdn.ccgateway.net
URL: https://carbon-cdn.ccgateway.net/script?id=paint.toys&parentId=5bb3e20859
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: bb49a28501d03a18c34788c4f2ce63bb58c188deb99bb62b4698de3534456bad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: public,max-age=1200
content-encoding: gzip
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding

GET
H2 200 script-load
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 54ms
32ms Image
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/script-load?engttl=60&engcount=0&engid=26d06e47-d1cb-4404-858f-bad5505e95e5&prevPvid=&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qsxcd.veronicabazan.cl&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=715fb2ee-5d3f-49dc-a350-3fe112920ea9&ccuid=83217f0e-fd5a-47d8-b8ca-e8db6f371db4&sid=e4298f86-5197-4f21-b4f1-bb5be8ec3d1a&nct=1749693855000&r=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&ns=true&lang=en-US&ua=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F137.0.0.0%20Safari%2F537.36&devicefp=206.66.99.143%3A2&browserCache=true&localCache=false&cookieType=0&nocookies=false&ios=false&parentId=5bb3e20859&scriptId=paint.toys&skey=10637fee-a6c6-4421-b01a-ca3f79f63c09&url=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 12 Jun 2025 02:04:15 GMT
content-length: 0

GET
H2 200 coreid.min.js Show response
secure.cdn.fastclick.net/js/cnvr-coreid/latest/ 229 KB
66 KB 35ms
33ms Script
application/javascript 184.24.70.89
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://secure.cdn.fastclick.net/js/cnvr-coreid/latest/coreid.min.js
Requested by: Host: secure.cdn.fastclick.net
URL: https://secure.cdn.fastclick.net/js/cnvr-launcher/latest/launcher.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.70.89 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-24-70-89.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: eb87c0447bd19366919bdb8913f775caca732ac31cbc5e5d42e4db5df39437ce

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=900
content-encoding: gzip
etag: "394d0-60864a57eaadc-gzip"
expires: Thu, 12 Jun 2025 02:19:15 GMT
accept-ranges: bytes
content-length: 67550
date: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Mon, 23 Oct 2023 16:23:46 GMT
content-type: application/javascript
server: Apache
vary: Accept-Encoding

GET
H2

200

match Show response
c1.adform.net/serving/cookie/ Frame 76EE
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&cid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=

35 B
599 B

30ms
30ms

Document
image/gif

185.167.164.53
ADFORM Adform A/S

General

Check archive.org

Download Go to

Full URL

https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.167.164.53 , Denmark, ASN198622 (ADFORM Adform A/S, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-type: image/gif
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: -1
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

Redirect headers

accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-max-age: 86400
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: -1
location: https://c1.adform.net/serving/cookie/match?CC=1&party=14&cid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

dcm Show response
s.amazon-adsystem.com/ Frame 727F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=858D235C-4A6F-4842-B9AD-130DED726F58&redir=true&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=858D235C-4A6F-4842-B9AD-130DED726F58&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

50ms
50ms

Document
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=858D235C-4A6F-4842-B9AD-130DED726F58&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 12 Jun 2025 02:04:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: HH9B819FX849MVZCZM8E

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Thu, 12 Jun 2025 02:04:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=858D235C-4A6F-4842-B9AD-130DED726F58&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: CCW8Z70MXWB57FNX3KVJ

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E86C
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=315100540158048298&gdpr=0&gdpr_consent=

42 B
216 B

34ms
34ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=315100540158048298&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 12 Jun 2025 02:04:15 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 0acbbfea-8149-442e-8b85-a0a7ad1479cd
cache-control: no-store, no-cache, private
content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=315100540158048298&gdpr=0&gdpr_consent=
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.23.4
x-proxy-origin: 206.66.99.143; 206.66.99.143; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
x-xss-protection: 0

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 68DC
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEbWkwN1FsR3NBQUJxY1dDRkdJUQ&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partneruserid=AADmi07QlGsAABqcWCFGIQ&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=4040010805317770454&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?ev=AADmi07QlGsAABqcWCFGIQ&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D4040010805317770454%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=4040010805317770454&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AADmi07...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AADmi07QlGsAABqcWCFGIQ&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58

0
351 B

54ms
25ms

Document
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://ads.pubmatic.com/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 12 Jun 2025 02:04:16 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

content-length: 115
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:14 GMT
location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 setuid Show response
prebid.intergient.com/ Frame 5273 0
833 B 150ms
49ms Document
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://prebid.intergient.com/setuid?bidder=pubmatic&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=858D235C-4A6F-4842-B9AD-130DED726F58
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?gdpr=&gdpr_consent=&us_privacy=&predirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 94e5c6c3d9840f9d-EWR
content-encoding: br
content-type: text/html
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: 0
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
pragma: no-cache
priority: u=0,i
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1749693855&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=vnPeUJYX2wmQst4AY4NzJemBlsPx9Q3U1EC6jbqb%2BSY%3D"}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1749693855&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=vnPeUJYX2wmQst4AY4NzJemBlsPx9Q3U1EC6jbqb%2BSY%3D
server: cloudflare
server-timing: cfExtPri
vary: Origin
via: 1.1 vegur

GET
H2

200

396846.gif
idsync.rlcdn.com/ Frame E122
Redirect Chain

https://idsync.rlcdn.com/420486.gif?partner_uid=858D235C-4A6F-4842-B9AD-130DED726F58
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=3fb1ff5a-7f33-49b1-a980-44f0e224cd5f

42 B
318 B

63ms
61ms

Image
image/gif

35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=3fb1ff5a-7f33-49b1-a980-44f0e224cd5f
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-cache, no-store
timing-allow-origin: *
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length: 42
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=3fb1ff5a-7f33-49b1-a980-44f0e224cd5f
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

lons7jax
sync-tm.everesttech.net/ct/upi/pid/ Frame E122
Redirect Chain

https://pixel.onaudience.com/?partner=214&mapped=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
https://pixel.onaudience.com/?partner=236&icm&cver&gdpr=0&smartmap=1&redirect=ps.eyeota.net%2Fpixel%3Fgdpr%3D0%26gdpr_consent%3D%26pid%3D3b2cb90%26t%3Dgif%26uid%3D%25m
https://ps.eyeota.net/pixel?gdpr=0&gdpr_consent=&pid=3b2cb90&t=gif&uid=61125f6b4cc86315
https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3D3b2cb90
https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3D3b2cb90&_test=aEo1nwAW93ECKQAL

85 B
171 B

31ms
31ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3D3b2cb90&_test=aEo1nwAW93ECKQAL
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1749693856.880540,VS0,VE0
age: 1307
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 2933

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26referrer_pid%3D3b2cb90&_test=aEo1nwAW93ECKQAL
x-timer: S1749693856.830547,VS0,VE8
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

dm4ha19W
rtd-tm.everesttech.net/ct/upi/pid/ Frame E122
Redirect Chain

https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=858D235C-4A6F-4842-B9AD-130DED726F58&sInitiator=external&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/pubmatic/1/info2?sType=sync&sExtCookieId=858D235C-4A6F-4842-B9AD-130DED726F58&sInitiator=external&gdpr=0&gdpr_consent=
https://sg.semasio.net/sync/1/15927723?&gdpr=0&gdpr_consent=&sInitiator=external&sExtCookieId=858D235C-4A6F-4842-B9AD-130DED726F58
https://match.adsrvr.org/track/cmf/generic?ttd_pid=semasio&ttd_tpi=1&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/tradedesk/1/info?sType=sync&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=076b09a3-2210-4a56-beb0-1d4c9f4faecb
https://sg.semasio.net/sync/1/32675800?&gdpr=0&gdpr_consent=&sInitiator=internal&sExtCookieId=076b09a3-2210-4a56-beb0-1d4c9f4faecb
https://ib.adnxs.com/getuid?https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F4354957%3FsExtCookieId%3D%24UID%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/4354957?sExtCookieId=315100540158048298&sInitiator=internal&gdpr=0&gdpr_consent=
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg1MjQ0NjQvdC8w/url/https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F9732522%3FsExtCookieId%3D%24!%7BTURN_UUID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://su.semasio.net/sync/1/9732522?sExtCookieId=3463038936866790899&sInitiator=internal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=
https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=a...

85 B
154 B

31ms
30ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aEo1oAAAFMaDIwBa
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1749693857.974083,VS0,VE0
age: 3329
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 516

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://rtd-tm.everesttech.net/ct/upi/pid/dm4ha19W?redir=https%3A%2F%2Fsu.semasio.net%2Fsync%2F1%2F19129194%3FsExtCookieId%3D%24%7BTM_USER_ID%7D%26sInitiator%3Dinternal&gdpr=0&gdpr_consent=&_test=aEo1oAAAFMaDIwBa
x-timer: S1749693857.935993,VS0,VE7
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E122
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=ODU4RDIzNUMtNEE2Ri00ODQyLUI5QUQtMTMwREVENzI2RjU4&gdpr=0&gdpr_consent=&google_cm
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDrmD77QKAabcrSY21Z4ct4&google_cver=1

42 B
295 B

176ms
51ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDrmD77QKAabcrSY21Z4ct4&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDrmD77QKAabcrSY21Z4ct4&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E122
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hY0jXEpvSEK5rRMN7XJvWA%3D%3D&gdpr=0&gdpr_consent=&google_cm
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPr3qgOxgZ2akpzZb0x2xOA&google_cver=1

20 KB
20 KB

40ms
36ms

Image
text/html

23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPr3qgOxgZ2akpzZb0x2xOA&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: max-age=91773
content-encoding: gzip
expires: Fri, 13 Jun 2025 03:33:48 GMT
accept-ranges: bytes
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 6694
date: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
content-type: text/html
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=&google_gid=CAESEPr3qgOxgZ2akpzZb0x2xOA&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 362
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E122
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOuEjFeX5I7y8azMw2uJnw0&google_cver=1

42 B
299 B

172ms
50ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOuEjFeX5I7y8azMw2uJnw0&google_cver=1
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

cache-control: no-cache, must-revalidate
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEOuEjFeX5I7y8azMw2uJnw0&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 379
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E122
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B18E03F17B1E453DA42531E9D32A73D9

42 B
513 B

49ms
49ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B18E03F17B1E453DA42531E9D32A73D9
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:B18E03F17B1E453DA42531E9D32A73D9
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 11 Jun 2025 02:04:15 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E122
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=

42 B
540 B

182ms
52ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif; charset=utf-8
server: nginx

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=
content-length: 355
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame E122
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=858D235C-4A6F-4842-B9AD-130DED726F58&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JRxOJQBE2uUFEcEMmzeIEstaDZbGTug-~A&gdpr=0

0
260 B

162ms
51ms

Image
text/plain

207.65.37.182
AS-PUBMATIC

General

Check archive.org

Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JRxOJQBE2uUFEcEMmzeIEstaDZbGTug-~A&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 207.65.37.182 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

cache-control: no-store, no-cache, private
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
server: nginx

Redirect headers

strict-transport-security: max-age=31536000
location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-JRxOJQBE2uUFEcEMmzeIEstaDZbGTug-~A&gdpr=0
age: 0
referrer-policy: no-referrer-when-downgrade
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html
server: ATS

GET
H2 200 858D235C-4A6F-4842-B9AD-130DED726F58
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame E122 43 B
521 B 282ms
37ms Image
image/gif 2600:1f18:4e9:5a01:7ef6:10d7:ddd0:da2f
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/858D235C-4A6F-4842-B9AD-130DED726F58?gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:1f18:4e9:5a01:7ef6:10d7:ddd0:da2f Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://ads.pubmatic.com/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 43
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: ATS
x-frame-options: DENY

GET
H2 200 403 Show response
p.ad.gt/api/v1/p/ 39 KB
14 KB 182ms
52ms Script
application/javascript 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/p/403
Requested by: Host: a.ad.gt
URL: https://a.ad.gt/api/v1/u/matches/403?_it=amazon
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2a5f558d1d777643d6cb00bc38a1d745afa9a34342ec545b6d82f3ee8e7e931

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: max-age=14400
content-encoding: gzip
cf-cache-status: HIT
age: 9936
cf-ray: 94e5c6c3fdeb43d3-EWR
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
vary: accept-encoding
server: cloudflare
last-modified: Wed, 11 Jun 2025 16:00:52 GMT

GET
H2 200 halo_match
ids.ad.gt/api/v1/ 43 B
170 B 298ms
145ms Image
image/gif 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/halo_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&halo_id=060ixefju6a659998996666666666666666uomowi0e0y66646600000000000000
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c42a3564b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

GET
H2 200 ip_match
ids4.ad.gt/api/v1/ 0
245 B 469ms
217ms Image
text/html 34.214.28.38
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://ids4.ad.gt/api/v1/ip_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.214.28.38 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-214-28-38.us-west-2.compute.amazonaws.com
Software: timberwolf /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
server: timberwolf

GET
H2

200

match
ids.ad.gt/api/v1/
Redirect Chain

https://secure.adnxs.com/getuid?https://ids.ad.gt/api/v1/match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&adnxs_id=$UID&gdpr=0
https://ids.ad.gt/api/v1/match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&adnxs_id=315100540158048298&gdpr=0

43 B
95 B

318ms
209ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&adnxs_id=315100540158048298&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c42a3a64b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&adnxs_id=315100540158048298&gdpr=0
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.143; 206.66.99.143; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: d7de1ecc-2969-4bd9-af55-e5df05c6d4b7
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

openx
ids.ad.gt/api/v1/
Redirect Chain

https://u.openx.net/w/1.0/cm?id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001749693855-4D7Y6C51-JWWW%26auid%3DAU...
https://u.openx.net/w/1.0/cm?cc=1&id=998eaf06-9905-4eae-9e26-9fac75960c53&r=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fopenx%3Fopenx_id%3D%7BOPENX_ID%7D%26id%3DAU1D-0100-001749693855-4D7Y6C51-JWWW%26auid...
https://ids.ad.gt/api/v1/openx?openx_id=b772b713-731c-4e54-83e4-06fc707985e1&id=AU1D-0100-001749693855-4D7Y6C51-JWWW&auid=AU1D-0100-001749693855-4D7Y6C51-JWWW

43 B
95 B

139ms
135ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/openx?openx_id=b772b713-731c-4e54-83e4-06fc707985e1&id=AU1D-0100-001749693855-4D7Y6C51-JWWW&auid=AU1D-0100-001749693855-4D7Y6C51-JWWW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c4cc0164b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: private, max-age=0, no-cache
location: https://ids.ad.gt/api/v1/openx?openx_id=b772b713-731c-4e54-83e4-06fc707985e1&id=AU1D-0100-001749693855-4D7Y6C51-JWWW&auid=AU1D-0100-001749693855-4D7Y6C51-JWWW
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: image/gif
vary: Accept, Accept-Encoding

GET
H2

200

pbm_match
ids.ad.gt/api/v1/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Fpbm_match%3Fpbm%3D%23PM_USER_ID%26id%3DAU1D-0100-001749693855-4D7Y6C51-JWWW
https://ids.ad.gt/api/v1/pbm_match?pbm=858D235C-4A6F-4842-B9AD-130DED726F58&id=AU1D-0100-001749693855-4D7Y6C51-JWWW

43 B
95 B

156ms
155ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/pbm_match?pbm=858D235C-4A6F-4842-B9AD-130DED726F58&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c47b3864b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: no-store, no-cache, private
location: https://ids.ad.gt/api/v1/pbm_match?pbm=858D235C-4A6F-4842-B9AD-130DED726F58&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Thu, 12 Jun 2025 02:04:15 GMT
server: nginx

GET
H2

200

rub_match
ids.ad.gt/api/v1/
Redirect Chain

https://token.rubiconproject.com/token?pid=50242&puid=AU1D-0100-001749693855-4D7Y6C51-JWWW&gdpr=0
https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&rub=MBSQJMTR-7-CU07&gdpr=0

43 B
95 B

149ms
149ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&rub=MBSQJMTR-7-CU07&gdpr=0
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c47b4964b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://ids.ad.gt/api/v1/rub_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&rub=MBSQJMTR-7-CU07&gdpr=0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: af308bb17a856a105b8c87aaae7d7f8c
Pragma: no-cache
content-length: 0

GET
H2

200

t_match
ids.ad.gt/api/v1/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=8gkxb6n&ttd_tpi=1&ttd_puid=AU1D-0100-001749693855-4D7Y6C51-JWWW&gdpr=0
https://ids.ad.gt/api/v1/t_match?tdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&id=AU1D-0100-001749693855-4D7Y6C51-JWWW

43 B
95 B

315ms
208ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/t_match?tdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c42a4164b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

location: https://ids.ad.gt/api/v1/t_match?tdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
content-length: 259
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

GET
H2

200

tapad_match
ids.ad.gt/api/v1/
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3185&partner_device_id=AU1D-0100-001749693855-4D7Y6C51-JWWW&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001749693855...
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3185&partner_device_id=AU1D-0100-001749693855-4D7Y6C51-JWWW&partner_url=https://ids.ad.gt%2Fapi%2Fv1%2Ftapad_match%3Fid%3DAU1D-0100-001749...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=e5afe47b-2841-4a97-bdcc-b86c67fc902c%252Chttps%25253A%25252F%25252Fids.ad.gt%25252Fapi%25252Fv1%25252Ftapad_match%25253Fi...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=076b09a3-2210-4a56-beb0-1d4c9f4faecb&ttd_puid=e5afe47b-2841-4a97-bdcc-b86c67fc902c%2Chttps%253A%252F%252Fids.ad.gt%252Fap...
https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&tapad_id=e5afe47b-2841-4a97-bdcc-b86c67fc902c

43 B
95 B

131ms
131ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&tapad_id=e5afe47b-2841-4a97-bdcc-b86c67fc902c
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c6796064b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

strict-transport-security: max-age=31536000
location: https://ids.ad.gt/api/v1/tapad_match?id=AU1D-0100-001749693855-4D7Y6C51-JWWW&tapad_id=e5afe47b-2841-4a97-bdcc-b86c67fc902c
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Jetty(11.0.25)

GET
H3 200 pixel
cm.g.doubleclick.net/ 170 B
188 B 47ms
43ms Image
image/png 172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_cm&google_sc&google_ula=450542624&id=AU1D-0100-001749693855-4D7Y6C51-JWWW

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H2

200

amo_match
ids.ad.gt/api/v1/
Redirect Chain

https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODI0MTY1OC90LzA/url/https%3A%2F%2Fids.ad.gt%2Fapi%2Fv1%2Famo_match%3Fturn_id%3D%24!%7BTURN_UUID%7D%26id%3DAU1D-0100-001749693855-4D7Y6C51-JWWW
https://ids.ad.gt/api/v1/amo_match?turn_id=3463038936866790899&id=AU1D-0100-001749693855-4D7Y6C51-JWWW

43 B
95 B

318ms
211ms

Image
image/gif

2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://ids.ad.gt/api/v1/amo_match?turn_id=3463038936866790899&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c42a3d64b8-EWR
cache-control: no-cache
content-length: 43
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: cloudflare

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ids.ad.gt/api/v1/amo_match?turn_id=3463038936866790899&id=AU1D-0100-001749693855-4D7Y6C51-JWWW
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 12 Jun 2025 02:04:32 GMT

GET us
sync.go.sonobi.com/ 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/
Redirect Chain

https://ids.ad.gt/api/v1/g_hosted?id=AU1D-0100-001749693855-4D7Y6C51-JWWW
https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0OTY5Mzg1NS00RDdZNkM1MS1KV1dX

170 B
188 B

53ms
52ms

Image
image/png

172.253.63.154
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0OTY5Mzg1NS00RDdZNkM1MS1KV1dX

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f154.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cf-ray: 94e5c6c47b2264b8-EWR
location: https://cm.g.doubleclick.net/pixel?google_nid=audigent_w_appnexus_3985&google_hm=QVUxRC0wMTAwLTAwMTc0OTY5Mzg1NS00RDdZNkM1MS1KV1dX
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
vary: accept-encoding
server: cloudflare

GET
H2 200 bounce Show response
id5-sync.com/ 30 B
299 B 123ms
121ms Fetch
text/plain 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/bounce

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

b04cd869cfd41a48c006458f71969a0eb26f33fec12f3cfe00408f8b73bf3ff8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/plain;charset=utf-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H/1.1 200
OK v1 Show response
lbs.eu-1-id5-sync.com/lbs/ 54 B
225 B 658ms
217ms Fetch
application/json 2001:41d0:701:1000::41bb
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL: https://lbs.eu-1-id5-sync.com/lbs/v1
Requested by: Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2001:41d0:701:1000::41bb , France, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
Software: /
Resource Hash: bf18e6476c0443210505e52122c82c8a549f3983e89419c12981ccad4166af93

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

access-control-allow-origin: https://paint.toys
content-length: 54
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 602ms
252ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

393e5cf6662ebe8a8cfe43b029391cc280ebe93478e1e80cfd316086812bd3d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11596%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=315100540158048298

0
354 B

42ms
37ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=315100540158048298
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11596&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&id=315100540158048298
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.143; 206.66.99.143; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 0d7fe873-8500-432c-990c-37c247c6f934
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:15 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://rtb.mfadsrvr.com/sync?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11611%26uid%3D%24%7BUUID%7D&ssp=rise
https://rtb.mfadsrvr.com/ul_cb/sync?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11611%26uid%3D%24%7BUUID%7D&ssp=rise
https://cs.yellowblue.io/cs?aid=11611&id=5923258f-e777-458e-8acd-53758a04ee20

0
354 B

36ms
36ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11611&id=5923258f-e777-458e-8acd-53758a04ee20
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11611&id=5923258f-e777-458e-8acd-53758a04ee20
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/ Frame F791
Redirect Chain

https://ssp-sync.criteo.com/user-sync/redirect?gdpr=0&gdpr_consent=&profile=342&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11614%26id%3D%24%7BCRITEO_USER_ID%7D
https://x.bidswitch.net/sync?ssp=criteo&custom_data=TvFAN19BOURma3lNNUVQODlRa1VDWVdiQlp6Q3MxZWglMkY2Q1FUbkdVTDVtJTJGNDJka2Y5ZUszajRxUHU0NFR0b3hFa0tPSnpCcklERmJZZm11UzJJbTljYVI0MyUyRk9DSUhtS2s2Sm5ZZ...
https://x.bidswitch.net/ul_cb/sync?ssp=criteo&custom_data=TvFAN19BOURma3lNNUVQODlRa1VDWVdiQlp6Q3MxZWglMkY2Q1FUbkdVTDVtJTJGNDJka2Y5ZUszajRxUHU0NFR0b3hFa0tPSnpCcklERmJZZm11UzJJbTljYVI0MyUyRk9DSUhtS2s...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=167a889f-aba5-4900-af59-559ea01d3c06&ssp=criteo&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10610410355518715501&ssp=criteo&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10610410355518715501&ssp=criteo&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=criteo
https://x.bidswitch.net/sync?dsp_id=419&user_id=10610410355518715501&ssp=criteo&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=i1asl19BOURma3lNNUVQODlRa1VDWVdiQlo2cjRaJTJCeHlrajR1QUlBM1hxcGFueUUlM0Q&u=167a889f-aba5-4900-af59-559ea01d3c06

0
141 B

34ms
33ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=i1asl19BOURma3lNNUVQODlRa1VDWVdiQlo2cjRaJTJCeHlrajR1QUlBM1hxcGFueUUlM0Q&u=167a889f-aba5-4900-af59-559ea01d3c06

Requested by

Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 12 Jun 2025 02:04:16 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //ssp-sync.criteo.com/user-sync/match?p=i1asl19BOURma3lNNUVQODlRa1VDWVdiQlo2cjRaJTJCeHlrajR1QUlBM1hxcGFueUUlM0Q&u=167a889f-aba5-4900-af59-559ea01d3c06
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:16 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://s.ad.smaato.net/c/?adExInit=rise&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11574%26id%3D%24UID
https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=5d13240627

0
354 B

52ms
50ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=5d13240627
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11574&id=5d13240627
content-length: 5
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/plain; charset=utf-8

GET
H2 200 cookie
cm.adform.net/ Frame F791 35 B
475 B 590ms
248ms Image
image/gif 37.157.6.254
ADFORM Adform A/S

General

Check archive.org

Download Go to Show image

Full URL: https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11606%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D%24UID
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 37.157.6.254 , Denmark, ASN198622 (ADFORM Adform A/S, DK),
Reverse DNS
Software: nginx /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-max-age: 86400
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
server: nginx
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://creativecdn.com/cm-notify?pi=rise
https://creativecdn.com/cm-notify?pi=rise&tc=1
https://cs.yellowblue.io/cs?aid=11610&id=HG-miAxKMH8IDbQmfzUsEADSdXei6Kr6UpIRNgbtPr8&pi=rise&tc=1

0
354 B

68ms
58ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11610&id=HG-miAxKMH8IDbQmfzUsEADSdXei6Kr6UpIRNgbtPr8&pi=rise&tc=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cs.yellowblue.io/cs?aid=11610&id=HG-miAxKMH8IDbQmfzUsEADSdXei6Kr6UpIRNgbtPr8&pi=rise&tc=1
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT, Thu, 12 Jun 2025 02:04:15 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=77&gdpr=0&gdpr_consent=
https://cs.yellowblue.io/cs?aid=11600&id=4040010805317770454&gdpr=0&gdpr_consent=

0
354 B

103ms
100ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11600&id=4040010805317770454&gdpr=0&gdpr_consent=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache,no-store
location: https://cs.yellowblue.io/cs?aid=11600&id=4040010805317770454&gdpr=0&gdpr_consent=
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 12 Jun 2025 02:04:14 GMT
pragma: no-cache

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26uid%3D%24%7BUID%7D
https://rtb.openx.net/sync/prebid?gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11563%26uid%3D%24%7BUID%7D&ox_sc=1
https://cs.yellowblue.io/cs?fwrd=1&aid=11563&uid=7ba92f26-f90f-4191-8934-48f021571dce

0
354 B

35ms
35ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&uid=7ba92f26-f90f-4191-8934-48f021571dce
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11563&uid=7ba92f26-f90f-4191-8934-48f021571dce
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:15 GMT
vary: Origin

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://contextual.media.net/cksync.php?cs=25&gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11585%26id%3D%3C...
https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3926954552718342000V10

0
354 B

90ms
89ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3926954552718342000V10
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=31536000
cache-control: max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11585&id=3926954552718342000V10
timing-allow-origin: *
pragma: no-cache
expires: Thu, 12 Jun 2025 02:04:15 GMT
x-mnet-hl2: E
alt-svc: h3=":443"; ma=93600
content-length: 154
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html
server: Apache

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?gdpr=0&gdpr=0&gdpr_consent=&gdpr_consent=&p=160295&pu=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11576%26id%3D%23PMUID
https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=6eb3f529-83d5-4e1e-8e01-397f6bb5f361&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4a11b50ac8801064&is_secure=true&networkId=17100&version=1&nuid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AQAHOulqyCL8iQJbpxYkAQEBAQEBAQCWYOB4eQEBAQEBAQEB&expiration=1749780256&nuid=858D235C-4A6F-48...
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=
https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58

0
354 B

56ms
30ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?aid=11576&fwrd=1&id=858D235C-4A6F-4842-B9AD-130DED726F58
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 115
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html; charset=utf-8

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://x.bidswitch.net/ul_cb/check_uuid/https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=167a889f-aba5-4900-af59-559ea01d3c06

0
354 B

35ms
34ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=167a889f-aba5-4900-af59-559ea01d3c06
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: https://cs.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=167a889f-aba5-4900-af59-559ea01d3c06
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://csync.loopme.me/?gdpr=0&gdpr_consent=&pubid=11362&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11571%26id%3D%7Bdevice_id%7D
https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=7e038c33-ff75-4a3c-afb3-a7c78f8db773&gdpr_consent=null&gdpr=0

0
354 B

74ms
33ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=7e038c33-ff75-4a3c-afb3-a7c78f8db773&gdpr_consent=null&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11571&id=7e038c33-ff75-4a3c-afb3-a7c78f8db773&gdpr_consent=null&gdpr=0
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: _

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://sync.go.sonobi.com/us?consent_string=&gdpr=0&loc=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D115667%26uid%3D%5BUID%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=6ba053c9-a9fa-4db7-987a-ff7ae1e63e84

0
354 B

43ms
43ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=6ba053c9-a9fa-4db7-987a-ff7ae1e63e84
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-cache, no-store, private
location: https://cs.yellowblue.io/cs?fwrd=1&aid=115667&uid=6ba053c9-a9fa-4db7-987a-ff7ae1e63e84
pragma: no-cache
expires: Sat, 26 Jul 1997 05:00:00 GMT
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
date: Thu, 12 Jun 2025 02:04:15 GMT
tcn: Choice
content-type: text/plain; charset=utf8
vary: negotiate,Accept-Encoding
server: sonobi-go
x-go-server: go-iad-2-5-153
x-xss-protection: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://match.sharethrough.com/universal/v1?gdpr=0&gdpr_consent=&supply_id=5926d422
https://cs.yellowblue.io/cs?aid=11587&uid=ab7f6870-93f9-425b-b00a-a9c126d644ee&gdpr=0

0
354 B

44ms
44ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11587&uid=ab7f6870-93f9-425b-b00a-a9c126d644ee&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cs.yellowblue.io/cs?aid=11587&uid=ab7f6870-93f9-425b-b00a-a9c126d644ee&gdpr=0
content-length: 0

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11580%26puid%3D33XUSERID33X
https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213180732547331

0
354 B

46ms
41ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213180732547331
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11580&puid=213180732547331
pragma: no-cache
referrer-policy: unsafe-url
expires: Thu, 01-Jan-70 00:00:01 GMT
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: 33XP003

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://ads.yieldmo.com/pbsync?gdpr=0&gdpr_consent=&is=rise&redirectUri=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11584%26uid%3D%24UID&us_privacy=
https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xhzxGeekixeGE0OSxr2J&gdpr=0&gdpr_consent=&us_privacy=

0
354 B

114ms
109ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xhzxGeekixeGE0OSxr2J&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&aid=11584&uid=xhzxGeekixeGE0OSxr2J&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
accept-ch: Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: *
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json;charset=utf-8
access-control-allow-headers: Cache-Control, Pragma, *

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://ads.stickyadstv.com/user-matching?gdpr=0&gdpr_consent=&id=3663
https://cs.yellowblue.io/cs?aid=11601&id=172834774562d061bd7c1a487ea47a9e&gdpr_consent=&gdpr=0

0
354 B

67ms
24ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11601&id=172834774562d061bd7c1a487ea47a9e&gdpr_consent=&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache
Location: https://cs.yellowblue.io/cs?aid=11601&id=172834774562d061bd7c1a487ea47a9e&gdpr_consent=&gdpr=0
Pragma: no-cache
x-sticky-vk: 1749693856040068-112
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Content-Length: 0
Date: Thu, 12 Jun 2025 02:04:16 GMT
Server: nginx

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://bh.contextweb.com/bh/rtset?ev=1&gdpr=0&gdpr_consent=&pid=562615&rurl=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11592%26uid%3D%25%25VGUID%25%25&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=pS5jBRRXCBol&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0

0
354 B

63ms
23ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=pS5jBRRXCBol&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

cache-control: private, max-age=0, no-cache, no-store
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11592&uid=pS5jBRRXCBol&ev=1&us_privacy=[US_PRIVACY]&gdpr_consent=&pid=562615&gdpr=0
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cw-server: bh-deployment-7d68fcf8fd-5zjv9
expires: -1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: en-US
server: Jetty(12.0.17)

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://visitor-risecode.omnitagjs.com/visitor/bsync?name=risecode&uid=40a3c28f9ffc73ee86df2bac2d2bb390&url=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26fwrd%3D1%26aid%3D11609%26id%3D%5BBUYER_I...
https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=f0ab14289aa4753f1cf90025f7e76f70

0
354 B

89ms
49ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=f0ab14289aa4753f1cf90025f7e76f70
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 1
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

location: https://cs.yellowblue.io/cs?fwrd=1&fwrd=1&aid=11609&id=f0ab14289aa4753f1cf90025f7e76f70
x-kong-request-id: fc8fe513fb898b3781b3f9371ecb6b28
via: kong/3.6.1
x-kong-upstream-latency: 3
x-kong-proxy-latency: 0
content-length: 0
p3p: CP="CAO PSA OUR"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=UTF-8
server: fasthttp

GET
H2

200

cs
cs.yellowblue.io/ Frame F791
Redirect Chain

https://sync.1rx.io/usersync2/rmphb?gdpr=%5BGDPR%5D&gdpr_consent=%5BUSER_CONSENT%5D&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11599%26uid%3D%5BRX_UUID%5D&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11599&uid=OPTOUT&us_privacy=

0
354 B

80ms
47ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11599&uid=OPTOUT&us_privacy=
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

expires: 0
cache-control: no-store, no-cache, must-revalidate
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11599&uid=OPTOUT&us_privacy=
date: Thu, 12 Jun 2025 02:04:16 GMT
pragma: no-cache
content-type: text/html
etag: OPTOUT

GET

sync
sync.inmobi.com/ Frame F791
Redirect Chain

https://sync.inmobi.com/prebid?gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&us_privacy=%5BUS_PRIVACY%5D
https://sync.inmobi.com/sync?redirect=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11595%26id%3D%7BID5UID%7D&gdpr_consent=&gdpr=0&us_privacy=[US_PRIVACY]&gdpr_pd=&source=2&google_push=&re...

0
0

GET
H3 200 setuid
prebid.intergient.com/ Frame F791 0
877 B 80ms
76ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=rise&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=ebaPKNvrk
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pbs-cs.yellowblue.io/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1749693856&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=jyi3jkRMxp%2FnaW6PcR2lRLgcy0%2BIXAd0GQaEP1kYgKE%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1749693856&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=jyi3jkRMxp%2FnaW6PcR2lRLgcy0%2BIXAd0GQaEP1kYgKE%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 94e5c6c87db20f9d-EWR
server: cloudflare

GET
H2

200

usync.html Show response
eus.rubiconproject.com/ Frame B4B3
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?endpoint=us-east&p=rise_engage
https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

269 B
379 B

242ms
94ms

Document
text/html

23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 12 Jun 2025 02:04:15 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
location: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
server: AkamaiGHost

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 942F
Redirect Chain

https://onetag-sys.com/usync/?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11581%26uid%3D%24%7BUSER_TOKEN%7D&tag=img&us_privacy=%5BUS_PRIVACY%5D
https://cs.yellowblue.io/cs?fwrd=1&aid=11581&uid=RTlNh_eKt_JtAfbQZZBk4PIR75rYfbT9imv7Z_a6yg4

0
354 B

35ms
35ms

Document
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11581&uid=RTlNh_eKt_JtAfbQZZBk4PIR75rYfbT9imv7Z_a6yg4
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 12 Jun 2025 02:04:15 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-cache, no-transform
content-length: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11581&uid=RTlNh_eKt_JtAfbQZZBk4PIR75rYfbT9imv7Z_a6yg4
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 8458
Redirect Chain

https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID
https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11607%26uid%3D%24UID&sovrn_retry=true
https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=K0QcALZH9o9xtCUvTjO_8Qm9

0
354 B

90ms
86ms

Document
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=K0QcALZH9o9xtCUvTjO_8Qm9
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 12 Jun 2025 02:04:15 GMT
server: istio-envoy
x-envoy-upstream-service-time: 1

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Content-Type
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: *
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11607&uid=K0QcALZH9o9xtCUvTjO_8Qm9
vary: Accept-Encoding

GET
H2

200

cs Show response
cs.yellowblue.io/ Frame 457F
Redirect Chain

https://ssp.disqus.com/redirectuser?consent_string=&gdpr=0&r=https%3A%2F%2Fcs.yellowblue.io%2Fcs%3Ffwrd%3D1%26aid%3D11612%26id%3D%24UID&sid=716
https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-4dd1e8a5-3792-3d9a-b04a-8da59d0d3592

0
354 B

51ms
49ms

Document
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-4dd1e8a5-3792-3d9a-b04a-8da59d0d3592
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pbs-cs.yellowblue.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://pbs-cs.yellowblue.io/
access-control-expose-headers: X-Reason
content-length: 0
content-type: application/javascript
date: Thu, 12 Jun 2025 02:04:15 GMT
server: istio-envoy
x-envoy-upstream-service-time: 0

Redirect headers

cache-control: no-store
content-length: 0
expires: 0
location: https://cs.yellowblue.io/cs?fwrd=1&aid=11612&id=ua-4dd1e8a5-3792-3d9a-b04a-8da59d0d3592
pragma: no-cache

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3799
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=EA_xp3xqWFhOSzdVVDJIaDd5L2JwZDB3eVIxbHRPNEUyZjZobnkvbjlBbTJDTDNwVkJyNjRSRXo3RCtvMmwwbUh6MzFHV3puVzcvYkpZWWhOUUZJUzBnajNncThoLzZrN2Fhb0gxSlREdnJPNFBiVU5yUjhmREdCYm5OTl...

425 B
1 KB

199ms
86ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=EA_xp3xqWFhOSzdVVDJIaDd5L2JwZDB3eVIxbHRPNEUyZjZobnkvbjlBbTJDTDNwVkJyNjRSRXo3RCtvMmwwbUh6MzFHV3puVzcvYkpZWWhOUUZJUzBnajNncThoLzZrN2Fhb0gxSlREdnJPNFBiVU5yUjhmREdCYm5OTlN6bnFwcVlkOW1HRGZvS2huS1VJMWNva3Q3ZDJWd0k2dndQQ2plWUdHbXBvazBLU1FoN0FDVWdKL0FJaVRvcTVlbGNMNVF6NEF1cE9pdTVRUWZlN2RiQStwcjg1VFZzQmdSOU5tUUN0TUZSYTlCSVFFbG52bkgwMDFUMUhqeWQ1dW8wU1haNEI0MDJNZEJEY3FBbkxtOUxXMTQrSHNna1hNNHlQam81OUdGdWpnc1VQWEVMYnMzUnNFL0xYQU5CRjlvV2MwczBENnw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

c81f6d8e5b2fea0f80ae6954d73b8cc4acba3eb47fd742a154fd0ea0f20f468b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1082355
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=EA_xp3xqWFhOSzdVVDJIaDd5L2JwZDB3eVIxbHRPNEUyZjZobnkvbjlBbTJDTDNwVkJyNjRSRXo3RCtvMmwwbUh6MzFHV3puVzcvYkpZWWhOUUZJUzBnajNncThoLzZrN2Fhb0gxSlREdnJPNFBiVU5yUjhmREdCYm5OTlN6bnFwcVlkOW1HRGZvS2huS1VJMWNva3Q3ZDJWd0k2dndQQ2plWUdHbXBvazBLU1FoN0FDVWdKL0FJaVRvcTVlbGNMNVF6NEF1cE9pdTVRUWZlN2RiQStwcjg1VFZzQmdSOU5tUUN0TUZSYTlCSVFFbG52bkgwMDFUMUhqeWQ1dW8wU1haNEI0MDJNZEJEY3FBbkxtOUxXMTQrSHNna1hNNHlQam81OUdGdWpnc1VQWEVMYnMzUnNFL0xYQU5CRjlvV2MwczBENnw&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 276298
expires: 0
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

GET
H3 200 adclick-.php Show response
fundingchoicesmessages.google.com/f/AGSKWxWwFK6hBo5OeNdOkBevf44vnJAQfm9xMPsH1-YmTKDY0zUsHs84pO5pju0739cwh762KQEf5ugN6DTxccM_dIoAa3UZGxSfmHi8GrcOuNOx3ww2mGVr2Be2QIgpnN97B0opn567mTAl7IP2e_qVFUxh5r6Qy... 54 B
109 B 54ms
53ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWwFK6hBo5OeNdOkBevf44vnJAQfm9xMPsH1-YmTKDY0zUsHs84pO5pju0739cwh762KQEf5ugN6DTxccM_dIoAa3UZGxSfmHi8GrcOuNOx3ww2mGVr2Be2QIgpnN97B0opn567mTAl7IP2e_qVFUxh5r6QyY-BlP4uYL3QB6bcXfnbVP3PNmdfyNTz/_/adclick-.php?zone_id=/streamads./adsa728./banner460x80.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.k16tUjFBpts.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMymRDfA7NO0Ubpc6qHktPYvwwefRQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0308ed190e7fce433dbab9dbd50d78a7d47f1357d24c0f88a219f9b48c9810e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-86ipn4Ao3Y0cdDzlwMOICg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmJw1ZBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8S7Nt5iPQzEZn63We2AuHD6bdZKIBbi4Zj_esUhNoEbK5oPMyppJOUXxifn55UUZSaVluQXpSWnpRanFpWlFsUbGRiZGpgZWOoZGMUXGAAA8vA9LA"
content-security-policy: script-src 'report-sample' 'nonce-86ipn4Ao3Y0cdDzlwMOICg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H3 200 lidar.js Show response
pagead2.googlesyndication.com/pagead/js/ 251 KB
79 KB 201ms
44ms Script
text/javascript 2607:f8b0:4004:c23::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.en_US.k16tUjFBpts.es5.O/d=1/exm=kernel_loader,loader_js_executable,web_iab_tcf_v2_signal_executable/ed=1/rs=AJlcJMymRDfA7NO0Ubpc6qHktPYvwwefRQ/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::9c Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e772f103c4c75cd1910acecb8e8f02a81309ea833394571783d37f2059ba6be4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: br
etag: 12307677796333090674
age: 2198
x-content-type-options: nosniff
expires: Thu, 12 Jun 2025 02:27:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 12 Jun 2025 01:27:37 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 81002
x-xss-protection: 0
server: cafe

POST
H3 204 AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 143ms
54ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-XpwxNr0eTz6VO6m1JDWi4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw15Bi-FB_mfUHEJv53Wa1A-LC6bdZK4FYiIdj_usVh9gEfqzY9pZRySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkamBka6BmYxRcYAABbdSvY"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-XpwxNr0eTz6VO6m1JDWi4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 330 KB
118 KB 55ms
54ms Script
application/javascript 2607:f8b0:4004:c19::61
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-FVWZ0RM4DH&l=audDataLayer

Requested by

Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c19::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc6a6518cb275291d56dba819ae944c526e35fd930e6acf512a1c3fc7796157b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: zstd
report-to: {"group":"ascgcycc:1077:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1077:0"}],}
expires: Thu, 12 Jun 2025 02:04:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1077:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1077:0
content-length: 120746
x-xss-protection: 0
server: Google Tag Manager

POST
H2 204 collect Show response
a.ad.gt/api/v1/ 0
89 B 189ms
187ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://a.ad.gt/api/v1/collect
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: text/plain
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c478191b58-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2 204 getpixels Show response
pixels.ad.gt/api/v1/ 0
88 B 335ms
145ms Script
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://pixels.ad.gt/api/v1/getpixels?tagger_id=edcc42ebc2b19550d2248e1d537f3ab2&url=https%3A%2F%2Fpaint.toys%2Foil%2F&code=%27none%27
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6c5ee5cc54d-EWR
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:15 GMT
server: cloudflare

POST
H2 200 match Show response
seg.ad.gt/api/v2/ 481 B
236 B 135ms
134ms XHR
application/json 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a71ef6de1b94326e33898cdf86d17b60d2cc8e957052eed0f4e6ba800917a478

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: DYNAMIC
cf-ray: 94e5c6c64be68cc0-EWR
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: origin, access-control-request-method, access-control-request-headers, accept-encoding
server: cloudflare

OPTIONS
H2 200 match
seg.ad.gt/api/v2/ Frame 0
0 291ms
132ms Preflight 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://seg.ad.gt/api/v2/match
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
allow: POST
cf-cache-status: DYNAMIC
cf-ray: 94e5c6c58ba98cc0-EWR
date: Thu, 12 Jun 2025 02:04:15 GMT
server: cloudflare
vary: origin, access-control-request-method, access-control-request-headers

POST
H3 204 AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 81ms
50ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YnX-T1SnC8qvmwe12c8tUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII0JBi-FB_mfUHEJv53Wa1A-LC6bdZK4FYiIdj_usVh9gEXnza_JpRySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkamBka6BmYxRcYAABrLiwO"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-YnX-T1SnC8qvmwe12c8tUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 38 KB
6 KB 407ms
406ms Fetch
text/plain 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=7628965857131070&correlator=4449106101985411&eid=31091881%2C31092805%2C95353385%2C95361096%2C31092945%2C83321073&output=ldjh&gdfp_req=1&vrg=202506110101&ptt=17&impl=fifs&gdpr=0&iu_parts=154013155%2C1024872%2C74068%2Cpublisher%3A1024872-website%3A74068-160x600%2Cpublisher%3A1024872-website%3A74068-160x600-CP%2Cpublisher%3A1024872-website%3A74068-160x600-CP-160x600&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2F5&prev_iu_szs=160x600%7C120x600&ifi=1&dids=pw-160x600_atf&adfs=3640230632&sfv=1-0-45&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1749693855496&lmt=1749693855&adxs=20&adys=614&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fpaint.toys%2Foil%2F&ref=https%3A%2F%2Fqsxcd.veronicabazan.cl%2F&vis=1&psz=180x1097&msz=160x-1&fws=4&ohw=180&topics=1&tps=1&htps=10&a3p=EjQKCnB1YmNpZC5vcmcSJGY2MDA5ODdjLWRhYjItNGQ4OC1iYmJkLWYwOWU0MjQzOTEwNVgBEigKEnJ1Ymljb25wcm9qZWN0LmNvbRIQTUFYQjRTWFQtMTUtN1UzR1gBEjYKDHB1Ym1hdGljLmNvbRIkNUNDODVGM0MtQkI0RS00QUY4LUE1NkYtQ0JFNEVDNkZBRTYyWAESHQoOZXNwLmNyaXRlby5jb20Y1OaFj_YySABSAghkEhgKCXlhaG9vLmNvbRii6YWP9jJIAFICCG8S7gEKCHJ0YmhvdXNlEtgBam1DWFBJN000VFNYenkwcFNoRTF6allUeGxnTzhoT0dYQmRlakZDZ01CamJZN1ZEcFJNMHpwZlRNRitCZFVkQzk2Q3RxbjZhRWVuWnBBbUFqbFBzR1pxWlRDWk5vcnEzMVJrOWJPSTA4RkhmTlBiK0ozZ2p2eVhOS1hZMmxGWTVockdSeS9FdmtwSzYrQnRNWG1xc1R4RU56VkpYZjNWSmF4bXBVcnhrakVSc3J4ekd4aUViOXBwZE1TZDZZWE5EQUo1dFBMM0pUSmVibTFPMW0zSmpFUT09GNvthY_2MkgAEhQKBW9wZW54GLDphY_2MkgAUgIIbxIbCgwzM2Fjcm9zcy5jb20Y1OaFj_YySABSAghkElMKDWNyd2RjbnRybC5uZXQSQGFjMTFmMDY2MDEzYTNjZTcyNDcyYjAxZTc0NTkxODVjYTAyY2MzMDIyZGYwZTY1ODFjMDdlOTBjMzllM2ZlOWVYARIzCglvcGVueC5uZXQSJDhmODM0MjM1LWY5ZmEtNDExMS05YjE0LTgwY2YzNGZlYTJjY1gBEocBCg5saXZlaW50ZW50LmNvbRJzMTYtZklPQ0N4SkJxYk8rV1FkN0JoajZMaEhGRC9HbHFhUjV6YmY4Y2FRcGQrTDA5T1JJNzhkS2MrcDFEVmZvVE5YTjdJeVhhNmluN2FoaTdXWmF2U250U0hZVy9DMHBBdC9SYmZjNlM5T2J6elJBQ1E9PVgBEjUKGWxpdmVpbnRlbnQudHJpcGxlbGlmdC5jb20SFjE4MDMwMjYzODA5MDkzNjI3OTI5NDVYAQ..&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1749693853156&idt=837&prev_scp=pos%3Datf%26slot_id%3Dpw-160x600_atf%26refresh%3Dfalse%26amazonBid%3Dfalse%26custom_path%3D160x600%26lld_id%3D5d60a5e86fa34039b03eeaa9732cf6c593854271%26price_floor%3Dna%26amznbid%3D2%26amznp%3D2%26hb_cache_path%3D%252Fpbc%252Fv1%252Fcache%26hb_format_s2s_pubmat%3Dbanner%26hb_size_s2s_pubmatic%3D160x600%26hb_pb_s2s_pubmatic%3D0.08%26hb_adid_s2s_pubmatic%3D139c6519a0468536%26hb_bidder_s2s_pubmat%3Ds2s_pubmatic%26hb_cache_host_s2s_ix%3Dprebid.adnxs.com%26hb_format_s2s_ix%3Dbanner%26hb_size_s2s_ix%3D160x600%26hb_pb_s2s_ix%3D0.19%26hb_adid_s2s_ix%3D1437487a55ff0c6c8%26hb_bidder_s2s_ix%3Ds2s_ix%26hb_format_grid%3Dbanner%26hb_size_grid%3D160x600%26hb_pb_grid%3D0.22%26hb_adid_grid%3D1354e7c03495bf02%26hb_bidder_grid%3Dgrid%26hb_format_rubicon%3Dbanner%26hb_size_rubicon%3D160x600%26hb_pb_rubicon%3D0.34%26hb_adid_rubicon%3D13754009eef7be64%26hb_bidder_rubicon%3Drubicon%26hb_format%3Dbanner%26hb_size%3D160x600%26hb_pb%3D0.34%26hb_adid%3D13754009eef7be64%26hb_bidder%3Drubicon%26bid_type%3Dclient&cust_params=pf_src%3Dml%26ad_clicker%3Dfalse%26li-module-enabled%3Dt1-e0%26cc-intent-id%3D218890240%252C469762048%26cc-iab-class-id%3D283%252C482%26cc-iab-name%3DHome%2520%2526%2520Garden.Interior%2520Decorating%252CShopping.Children%27s%2520Games%2520and%2520Toys%26brand_safety_checked%3Dtrue%26salad%3Dchef%26dd%3Draspberry%26di%3Dpineapple%26vd%3Draspberry%26vi%3Dpineapple%26sitecont_cat%3Dgames_casual%26referrer%3Dhttps%253A%252F%252Fqsxcd.veronicabazan.cl%252F%26tyche_code%3DV.20250609.1%26pageos_code%3DV.20250609.1%26config_id%3D1024872_74068_primary_config%26hour%3D16%26day%3DWednesday%26referrer_domain%3Dqsxcd.veronicabazan.cl%26OS%3DLinux%2520null%26browser%3DChrome%2520137%26pagecount%3D1%26window_width%3D1600%26window_height%3D1200%26screen_orientation%3Dlandscape%26website_id%3D74068%26pub_id%3D1024872%26refresh_count%3D0%26tyche_version%3DV.20250609.1%26ab_test%3Dna_A%26dmp_ids%3D65%26page_focus%3Dtrue&adks=2747221344&frm=20&eoidce=1&gblpids=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160&pbbce=1&td=1&egid=17819&tan=a697e1df-5725-4f35-8a3b-89cefe019ea6&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ac6a08f7fe23c00cff928c08b2d0f04ecb363d9fc951d12139bff79352d5da9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: dcb
google-lineitem-id: -1
observe-browsing-topics: ?1
x-content-type-options: nosniff
google-mediationtag-id: 1320085
google-mediationgroup-id: 739909
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://paint.toys
content-length: 6151
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame 2684 7 KB
3 KB 172ms
39ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 274ms
272ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-3-89-39-255.compute-1.amazonaws.com

Software

Resource Hash

dac27c606e38460274b0c9c819617c709d862264d3dbaf823b6865a3e6cba573

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H3 204 AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 51ms
51ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-22hP58dfYnOFiWbcmeVs5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII0JBi-FB_mfUHEJv53Wa1A-LC6bdZK4FYiIdj_usVh9gEbnSufcuk5JKUXxifnJ9XkppXopuYUqwLYhdlJpWW5BehsFPLQCpy8tPTM_PS440MjEwNzAwN9AzM4gsMAEdFK5I"
content-security-policy: script-src 'report-sample' 'nonce-22hP58dfYnOFiWbcmeVs5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

POST
H3 204 AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 50ms
48ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxUmdYbexvTc3WVmdXPJWTwfzGOTCCw7D60n56yioK_YVjEFfPF1TrKKr8KiTDtccESzeCKOr5RskLoX2FbWGYJaFZD9OzbAgDkXUAO4KkjX7vuCPp_bN9AI7GpDTXGzUjVDVPy1jQ==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-R1eOXl16Zi9gIwP4wu8GpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmLw1ZBi-FB_mfUHEJv53Wa1A-LC6bdZK4FYiIdj_usVh9gEbmw6-ZZJySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkamBka6BmYxRcYAABZyyvU"
content-security-policy: script-src 'report-sample' 'nonce-R1eOXl16Zi9gIwP4wu8GpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H3 200 AGSKWxVL1FtrhnZmlRo3Tx5sGKJ5jd9q02rbkIQOFj2XeUec_ahkpgq-2U4KqoA68KWVx8YJY5m-3-DLoec901SPlVuxfE8TTCufM-Nx4dy8AznwzZVqTVhlrNErKV-YTd2ddnKsCam6nw== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 71ms
70ms Script
application/javascript 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxVL1FtrhnZmlRo3Tx5sGKJ5jd9q02rbkIQOFj2XeUec_ahkpgq-2U4KqoA68KWVx8YJY5m-3-DLoec901SPlVuxfE8TTCufM-Nx4dy8AznwzZVqTVhlrNErKV-YTd2ddnKsCam6nw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzQ5NjkzODU1LDc0MTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOSw2XSxudWxsLDIsbnVsbCwiZW4iLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCwxXSwiaHR0cHM6Ly9wYWludC50b3lzL29pbC8iLG51bGwsW1s4LCJrMTZ0VWpGQnB0cyJdLFs5LCJlbi1VUyJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCJxc3hjZC52ZXJvbmljYWJhemFuLmNsIl0sWzI5LCJmYWxzZSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31896985c8ea1cde63b8827a1e72b6a8cd5d4d13762c157bae002cefae2a75a4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Jmot2-yzzMC70sJ5AL-kXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/javascript; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStDikmLw1JBiaL15jnU6EBsqXGJ1BuL76y6xPgfiD_WXWX8AcZHEFdYWIP5UdYNVpPoGaxL7TdYSIA51vMkaC8S7Nt5iPQzEZn63We2AuHD6bdZKIBbi4Zj_esUhNoEbj999Z1LSSMovjE_OzyspykwqLckvSktOSy1OLSpLLYo3MjAyNTAzsNQzMIovMAAAG9M-Cw"
content-security-policy: script-src 'report-sample' 'nonce-Jmot2-yzzMC70sJ5AL-kXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin: *
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B4B3 46 KB
12 KB 73ms
73ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 0dfd0e87b108fd1adcf6393504749f73be23c6a5dea2236563bc619a89b05343

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html?endpoint=us-east&p=rise_engage

Response headers

cache-control: max-age=48379
content-encoding: gzip
expires: Thu, 12 Jun 2025 15:30:34 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11651
date: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Wed, 11 Jun 2025 15:30:34 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

POST
H3 200 m1fntmx5yn5tl1tkdcgwikk_u9
faucetfoot.com/ 2 B
25 B 147ms
55ms Ping
application/json 2600:1901:0:2b4c::1
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL

https://faucetfoot.com/m1fntmx5yn5tl1tkdcgwikk_u9

Requested by

Host: faucetfoot.com
URL: https://faucetfoot.com/build/rhtp14sqsfk3

Protocol

Security

QUIC, , AES_128_GCM

Server

2600:1901:0:2b4c::1 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

hoothoot/1849279123 /

Resource Hash

4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=15724800; preload
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: POST, OPTIONS
via: fen-hoothoot-us-east1-spot-zzqg.gce-us-east1, 1.1 google
expires: Thu, 12 Jun 2025 02:04:14 GMT
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding, Origin
server: hoothoot/1849279123
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie

POST
H3 204 AGSKWxXJH9MNobIgtdnfHvSQmNmTtuPBchqgO_124wtX7nMc25sueU2_IaSvn_bf8J-X7Umw-S63_X8cFi8G9uV67DBJDv9ezs0weezVh0btR8ROZQLKAcjeCZ8ks-j8QOQ7MFEV6F2UKw== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 55ms
54ms XHR
text/html 2607:f8b0:4004:c06::8a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXJH9MNobIgtdnfHvSQmNmTtuPBchqgO_124wtX7nMc25sueU2_IaSvn_bf8J-X7Umw-S63_X8cFi8G9uV67DBJDv9ezs0weezVh0btR8ROZQLKAcjeCZ8ks-j8QOQ7MFEV6F2UKw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c06::8a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TnSvj4Sh_caUEyG1XG_nZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
reporting-endpoints: default="/_/ContributorLoggingHttp/web-reports?context=eJzjUtDikmII1pBi-FB_mfUHEJv53Wa1A-LC6bdZK4FYiIdj_usVh9gEXty8N4VZySUpvzA-OT-vJDWvRDcxpVgXxC7KTCotyS9CYaeWgVTk5KenZ-alxxsZGJkamBka6BmYxRcYAABZnSvO"
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-TnSvj4Sh_caUEyG1XG_nZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin: https://paint.toys
content-length: 0
x-xss-protection: 0
server: ESF

GET
H2 422 v1
match.sharethrough.com/FGMrCMMc/ 0
228 B 257ms
59ms Image
text/plain 3.89.39.255
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://match.sharethrough.com/FGMrCMMc/v1?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirectUri=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dsharethrough%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Di%26uid%3D%24UID

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.89.39.255 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16000000; includeSubDomains; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
content-length: 0

POST
H2 200 v3 Show response
id5-sync.com/gm/ 1 KB
2 KB 134ms
129ms XHR
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

Software

Resource Hash

f6c91884ca22017e158d1e744d41b4748876d7eb7c32b9fdab3eedf739c44e48

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 join-ad-interest-groups.html Show response
proton.ad.gt/ Frame 7738 5 KB
2 KB 180ms
52ms Document
text/html 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://proton.ad.gt/join-ad-interest-groups.html
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58682193341bc78ac7cc24e8d009280dfb2fe493ebb7e4d499783644413e6ab0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
ad-auction-allowed: true
age: 3165
apigw-requestid: MBsR6iSAPHcEPIA=
cache-control: max-age=14400
cf-cache-status: HIT
cf-ray: 94e5c6c8585af82f-EWR
content-encoding: br
content-type: text/html
date: Thu, 12 Jun 2025 02:04:16 GMT
last-modified: Thu, 12 Jun 2025 01:02:55 GMT
server: cloudflare
supports-loading-mode: fenced-frame
vary: Accept-Encoding

GET
H3 200 container.html Show response
91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame BAED 7 KB
0 0ms
0ms Document
text/html 2607:f8b0:4004:c1d::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3121
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Thu, 08 May 2025 23:15:48 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8B83 20 KB
7 KB 32ms
32ms Document
text/html 23.62.164.208
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=158326
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.62.164.208 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-62-164-208.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: a88123f7890e58349e3a64226c716be9d346a42ba76e542a8ebdd30026a89604

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=91772
content-encoding: gzip
content-length: 6694
content-type: text/html
date: Thu, 12 Jun 2025 02:04:16 GMT
expires: Fri, 13 Jun 2025 03:33:48 GMT
last-modified: Wed, 13 Nov 2024 05:14:24 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 pd Show response
playwire-d.openx.net/w/1.0/ Frame 29F6 803 B
1 KB 59ms
53ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://playwire-d.openx.net/w/1.0/pd
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 2427d9e08956baeaadb0616c242cc6476869644cf16ca830fd2de479ac67b1a6

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0, no-cache
content-length: 803
content-type: text/html
date: Thu, 12 Jun 2025 02:04:15 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
pragma: no-cache
vary: Accept, Accept-Encoding
via: 1.1 google
x-forwarded-for: 206.66.99.143

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B51A 52 KB
17 KB 170ms
30ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 64675
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 12 Jun 2025 02:04:16 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 23 Jan 2025 21:34:45 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 2252101, 96845
X-Served-By: cache-lga21993-LGA, cache-ewr-kewr1740082-EWR
X-Timer: S1749693856.143473,VS0,VE0

GET
H2 200 sync Show response
eb2.3lift.com/ Frame 3F86 1 KB
2 KB 206ms
20ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: b9f7fbe39a0ea8c7da7905bef5d6ad4411087bf477771f9f401b3d2cd8bca25c

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1097
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:16 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 204 /
sync.cootlogix.com/api/sync/iframe/ Frame 091D 0
0 218ms
46ms Document
text/plain 143.198.181.6
DIGITALOCEAN-ASN

General

Check archive.org

Download Go to

Full URL: https://sync.cootlogix.com/api/sync/iframe/?cid=665db4754b2ec067196b8f78&gdpr=0&gdpr_consent=&us_privacy=&coppa=0
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 143.198.181.6 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
access-control-allow-methods: GET, HEAD, OPTIONS, POST
access-control-allow-origin: *
date: Thu, 12 Jun 2025 02:04:16 GMT
p3p: CP="NOI DSP COR PSAo PSDo OUR IND UNI COM NAV ADMa"

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 1959 16 KB
6 KB 46ms
45ms Document
text/html 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=criteoPrebidAdapter&topUrl=paint.toys&gpp=

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

41446a7078f22662b9d265e40764760dd615b13d704c6cdd9983991c94cfaf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel
server-processing-duration-in-ticks: 830234
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding
x-robots-tag: noindex

GET
H2 200 usync.html Show response
eus.rubiconproject.com/ Frame B11C 269 B
379 B 56ms
56ms Document
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) /
Resource Hash: e4df52d49c57bc3e7158cb052cc05c60f1258c24de5c5728dac5d43272943ad9

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 224
content-type: text/html
date: Thu, 12 Jun 2025 02:04:16 GMT
etag: "10d-629840acea280-gzip"
last-modified: Wed, 18 Dec 2024 04:42:34 GMT
server: Apache/2.4.62 (Debian)
vary: Accept-Encoding

GET
H2 200 ixmatch.html Show response
js-sec.indexww.com/um/ Frame 7708 3 KB
2 KB 192ms
26ms Document
text/html 104.18.25.18
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.18 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 82d2dc44aae1eda52abc17afd30c6031b7175c13ee6955410164c66ae755adfb

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 522
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 94e5c6c8fe7c0e82-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 12 Jun 2025 02:04:16 GMT
expires: Thu, 12 Jun 2025 06:04:16 GMT
last-modified: Mon, 25 Jul 2022 19:18:19 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
server: cloudflare
vary: Accept-Encoding

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 34ms
30ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=6bFb3l9pJTJGb1FlOFNUOG90SUF6bllyUnolMkZZVjFVREVBczJPaUN5b0F5MmZaTjNFcW95ZXRvM1JpY21uWW54NXBnTEQ3Rmo3UjNja2Y5ZGdVWjlZT3d1RFA2UXM4dGhwaEd0OG03SzdVWUQlMkZQOGpuT2ZWRFljZW1KaFhaZ3Z6U3FrS1lhU3ByN2luWFJDeG5VYVlFcVdBZUVCWGclM0QlM0Q&cw=1&pbt=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://paint.toys
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 260266
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 195 B
470 B 141ms
139ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-34-195-248-99.compute-1.amazonaws.com

Software

Resource Hash

7e4d2c9111e1ca31b5e2e4bfd5a66925f07c0c232672f31481c6b66a89b26f16

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 f Show response
fid.agkn.com/ 130 B
659 B 35ms
35ms Fetch
application/javascript 44.195.224.25
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://fid.agkn.com/f?apiKey=2104320612&r=https%3A%2F%2Fpaint.toys%2Foil%2F
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.195.224.25 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-195-224-25.compute-1.amazonaws.com
Software: AAWebServer /
Resource Hash: b5d5d0fcff2220ecf8f17cb574072ae6cc0c561b371e549ddeedad64e807816a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 130
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript;charset=iso-8859-1
vary: Origin
server: AAWebServer
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 112 B
166 B 54ms
50ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0014000001YrMoYAAV&gdpr=0&src=pbjs&ver=9.43.0&coppa=0&tp=rCceNe%2FVlz2zX1s7Jmi%2FUnNiWuqtH4TqD5aMKqBpk4s%3D
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 9bc749335fb6f2995d5e3d2972909c362fa95b62982c0812db2ab1162f71378e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://paint.toys
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 112
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json
vary: origin

GET
H2 200 any Show response
idx.liadm.com/idex/did-0046/ 339 B
0 1ms
1ms Fetch
text/plain 52.5.253.69
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://idx.liadm.com/idex/did-0046/any?duid=8e413bd09c43--01jxgy2wh53be604v3zh5vewwt&did=did-0046&cd=.paint.toys&pu=https%3A%2F%2Fpaint.toys&resolve=nonId&resolve=uid2&resolve=index&resolve=bidswitch&resolve=pubmatic&resolve=magnite&resolve=openx&resolve=sorvrn&resolve=thetradedesk&resolve=medianet&resolve=vidazoo&resolve=sonobi&resolve=sharethrough&resolve=triplelift
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.253.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-253-69.compute-1.amazonaws.com
Software: /
Resource Hash: 742f7f9cf3b240ccfc69aff171c811b1fefd54aaec45fee72370d3218499d2bf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://paint.toys/

Response headers

cache-control: max-age=86399, private
trace-id: 0355566d633c3aab
request-time: 3
access-control-allow-credentials: true
expires: Fri, 13 Jun 2025 02:04:14 GMT
access-control-allow-origin: https://paint.toys
content-length: 339
date: Thu, 12 Jun 2025 02:04:14 GMT
content-type: text/plain; charset=UTF-8
vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpaint.toys%2F&domain=paint.toys&bundle=6bFb3l9pJTJGb1FlOFNUOG90SUF6bllyUnolMkZZVjFVREVBczJPaUN5b0F5MmZaTjNFcW95ZXRvM1JpY21uWW54NXB...
https://mug.criteo.com/sid?cpp=zZNHJHw1TUVrRzIzK1J5UFZjYmEwMno2NkNWUUIrZC9VR2JnK0d4ZCtuVzdyYkY4ZmlMY0JRN2VaSkpLTmZrMXNOb1dzd29taDdDVGhQWDFUckx2S2lSWWxxY3gzS0twdlpCZjRXb1d3aS9JTHJyK3JkL3ZiaTloSyt3eG...

426 B
1 KB

56ms
35ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=zZNHJHw1TUVrRzIzK1J5UFZjYmEwMno2NkNWUUIrZC9VR2JnK0d4ZCtuVzdyYkY4ZmlMY0JRN2VaSkpLTmZrMXNOb1dzd29taDdDVGhQWDFUckx2S2lSWWxxY3gzS0twdlpCZjRXb1d3aS9JTHJyK3JkL3ZiaTloSyt3eGhuL3E1dkExMkU0dUpMT1FmUEJ4YnR5NlpHTGVGelNSME1mVEx0T1VOei9MZi9Lbm5JOW1OMU9JbStMTksrK1J0ekwybm41RndnT0Zpa3BoRFNiNmQ2bXVmdHVnS2hQNkdVMURtUnhkQXJJUityTmhJY1F3ZXZlRTU0ejRxMi9Pb281cVpWQVVUc283Q3dBM3ZiR0M3eDJ3NUlvRW9EVnBkY3Y3V0ZLZGo0OEwwUjF3Z3hEakpIam00NUozMkU0RTIyY2NMbUo2anw&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ef06aee80f68ecd3a5f50d041f85d19144933ac5e9012c4615e238fe635d3c50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 880004
expires: 0
access-control-allow-origin: null
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=zZNHJHw1TUVrRzIzK1J5UFZjYmEwMno2NkNWUUIrZC9VR2JnK0d4ZCtuVzdyYkY4ZmlMY0JRN2VaSkpLTmZrMXNOb1dzd29taDdDVGhQWDFUckx2S2lSWWxxY3gzS0twdlpCZjRXb1d3aS9JTHJyK3JkL3ZiaTloSyt3eGhuL3E1dkExMkU0dUpMT1FmUEJ4YnR5NlpHTGVGelNSME1mVEx0T1VOei9MZi9Lbm5JOW1OMU9JbStMTksrK1J0ekwybm41RndnT0Zpa3BoRFNiNmQ2bXVmdHVnS2hQNkdVMURtUnhkQXJJUityTmhJY1F3ZXZlRTU0ejRxMi9Pb281cVpWQVVUc283Q3dBM3ZiR0M3eDJ3NUlvRW9EVnBkY3Y3V0ZLZGo0OEwwUjF3Z3hEakpIam00NUozMkU0RTIyY2NMbUo2anw&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 317218
expires: 0
access-control-allow-origin: https://paint.toys
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

GET
H2

200

sync
x.bidswitch.net/
Redirect Chain

https://x.bidswitch.net/sync?ssp=themediagrid
https://gw-iad-bid.ymmobi.com/adx/user/sync?pubid=eWg=&gdpr=&gdpr_consent=&us_privacy=&bidswitch_ssp_id=themediagrid&bsw_custom_parameter=167a889f-aba5-4900-af59-559ea01d3c06&callback=https%3A%2F%2...
https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_d600b01a-9c15-4cbd-b8cb-176cf1af8019&bsw_param=167a889f-aba5-4900-af59-559ea01d3c06

43 B
103 B

60ms
40ms

Image
image/gif

35.211.202.130
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_d600b01a-9c15-4cbd-b8cb-176cf1af8019&bsw_param=167a889f-aba5-4900-af59-559ea01d3c06
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 35.211.202.130 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 130.202.211.35.bc.googleusercontent.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token
access-control-allow-origin: *
location: https://x.bidswitch.net/sync?dsp_id=257&ssp=themediagrid&user_id=ym_user_d600b01a-9c15-4cbd-b8cb-176cf1af8019&bsw_param=167a889f-aba5-4900-af59-559ea01d3c06
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE

GET
H2

200

ibs:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb
dpm.demdex.net/
Redirect Chain

https://match.adsrvr.org/track/usersync?us_privacy=&gdpr=0&gdpr_consent=undefined&ust=image
https://dpm.demdex.net/ibs:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://dpm.demdex.net/ibs:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb

42 B
716 B

58ms
34ms

Image
image/gif

34.195.248.99
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

34.195.248.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs: dcs-prod-va6-1-v077-050df555c.edge-va6.demdex.com 2 ms
content-encoding: gzip
pragma: no-cache
x-content-type-options: nosniff
x-tid: GqEgDSG8SYs=
expires: Thu, 01 Jan 1970 00:00:00 UTC
content-length: 59
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb
content-length: 189
date: Thu, 12 Jun 2025 02:04:16 GMT
server: Kestrel

GET
H2 200 ad-impression-gpt
ingestion-router-api.ccgateway.net/v1/event/record/ 0
44 B 48ms
41ms Image
text/plain 52.91.215.149
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ingestion-router-api.ccgateway.net/v1/event/record/ad-impression-gpt?engttl=60&engcount=0&engid=26d06e47-d1cb-4404-858f-bad5505e95e5&prevPvid=715fb2ee-5d3f-49dc-a350-3fe112920ea9&pageVisits=1&landingUrl=https%3A%2F%2Fpaint.toys%2Foil%2F&extReferer=qsxcd.veronicabazan.cl&url=https%3A%2F%2Fpaint.toys%2Foil%2F&pvid=715fb2ee-5d3f-49dc-a350-3fe112920ea9&ccuid=83217f0e-fd5a-47d8-b8ca-e8db6f371db4&sid=e4298f86-5197-4f21-b4f1-bb5be8ec3d1a&nct=1749693856000&slotName=%2F154013155%2F1024872%2F74068%2Fpublisher%3A1024872-website%3A74068-160x600%2Fpublisher%3A1024872-website%3A74068-160x600-CP%2Fpublisher%3A1024872-website%3A74068-160x600-CP-160x600&divId=pw-160x600_atf&yieldGroupIds=739909&size=160%2C600&sourceAgnosticLineItemId=6754736285&sourceAgnosticCreativeId=138482150088&campaignId=375859515&advertiserId=51353235&isBackfill=true&scriptId=paint.toys&parentId=5bb3e20859
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.91.215.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-91-215-149.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

date: Thu, 12 Jun 2025 02:04:16 GMT
content-length: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame BAED 0
0 100ms
87ms Fetch
text/html 2607:f8b0:4004:c08::9d
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CEdIinzVKaP3UJ6-yqMwPlMqZ4AnukrWTXL-ihcfkBcCNtwEQASAAYMnusIfco8QQggEXY2EtcHViLTU4MTIzNTczNTIzMzUwNzXIAQngAgCoAwHIAwKqBOECT9Dub5qIQ6McVmWUYmimp8I73a1FAifqFD3Sir32b5G8bsna9kgPJvfYlXgXyDOK15ZT15mf_rCHdOGMbpa899ExtVgBLKpzPfxygYcGXmUIE_8P90-5rFPcy6ZhRuPxuVf4VrakkBO1CB0cI4WuT6FYJvrh_eQ0OzZ7YMbiXeezVtj2l-aDJZiHg5AgqCvxfw1c52VDZNZDsypGyfJ2iuAbDzihcYQC2v1vogJcgAIoTmusbJJvczwqIlUhozq68NF1jSI-_35gUEsKOiW90XBbaiB75CSyqgdlNaOUoMfWq6Mjj-3FjGuvXxsBD8dOMWn8jM_sgnKjUWP1UHw8Z25XDrr4gjjFFe0pT9yD5hc_PoKT-1C5QhPG0ZL__-VBRMcZDAf75i7lVoEnH2aUDzaoxUM1zDhr1XBL3G4GIf_azZA4hJRglXTR5wU2AXzWPBdg31KLyLd8KW3RkPAPjEDgBAGABqDcz_HWwoqgpQGgBiGoB6a-G6gHltgbqAeqm7ECqAf_nrECqAffn7ECqAetvrEC2AcA0ggmCIBhEAEyAooCOg2AQIDAgICAgKiAAqADSL39wTpY1cnoxeXqjQOACgP6CwIIAYAMAaoNAlVT4g0TCJ2D6cXl6o0DFS8ZigMdFGUGnOoNEwjEjerF5eqNAxUvGYoDHRRlBpzQFQGAFwGyFywKGhIUcHViLTU4MTIzNTczNTIzMzUwNzUY26IhGAsqCjIxODQzNjczNDZQAQ&sigh=n-mHnEYF_OM&uach_m=%5BUACH%5D&cid=CAQSPADZpuyz1P42T_RWuKcm8AnvdDhbjjj0WmpktvTgDh2pfcQnTYnqvBAVlaYtH8GOQ1flrQMylnvB4MZTiRgB
Requested by: Host: qsxcd.veronicabazan.cl
URL: https://qsxcd.veronicabazan.cl/efjmtijsk5li50eph4q13tiaRSUNWYkRZU2lqN1RDbjFxajBNQkQtMzM1MC0yNjE2MzQ0OC0wZmE5MDI2ZS01Mjk1LXBuaHBMa1FmUkRZMW5aTkQ5cjg5/lb5qramje1b/WtbnpjFGUT555q/491237190041802938881286832987775
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c08::9d Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

GET
H2 200 ttj Show response
ib.3lift.com/ Frame BAED 5 KB
3 KB 201ms
35ms Script
application/javascript 2600:9000:2807:1200:d:c38f:29c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ib.3lift.com/ttj?inv_code=pwm_general_RON_hdx
Requested by: Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2807:1200:d:c38f:29c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 1361fbfcb8ce95f3f81b7cf8b9863de692c3e04fe9a9b4d04276e1382e0ee86e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

cache-control: public, max-age=900
content-encoding: br
etag: W/"71d7c07b9bdc83a8f1c550115c158f5501ef8cd1"
age: 809
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: R_Rl7qSgG57mwRxjZPmOeUDLv1eOBhjbeGFC3kCR_vhcXYDVKFrFbg==
date: Thu, 12 Jun 2025 01:50:48 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
x-amz-cf-pop: JFK52-P6

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250610/r20110914/client/ Frame BAED 3 KB
1 KB 200ms
44ms Script
text/javascript 2607:f8b0:4004:c08::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250610/r20110914/client/window_focus_fy2021.js

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fec5a361dec923efe92848ca27b02b158b164380a9eaf6cc1625e08e0d9c101e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6020003950853699975
age: 3909
x-content-type-options: nosniff
expires: Thu, 26 Jun 2025 00:59:07 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 12 Jun 2025 00:59:07 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1241
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250610/r20110914/client/ Frame BAED 19 KB
8 KB 199ms
44ms Script
text/javascript 2607:f8b0:4004:c08::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250610/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7610d38431f342892fdabf98f52fd611c9944708caa14eed9f01436b814bf0ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 996829054598889070
age: 3749
x-content-type-options: nosniff
expires: Thu, 26 Jun 2025 01:01:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 12 Jun 2025 01:01:47 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8100
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame BAED 0
0

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-45/js/ Frame BAED 23 KB
6 KB 195ms
41ms Script
text/javascript 2607:f8b0:4004:c08::84
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-45/js/ext.js

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c95e84767aed248594e7d485707c7ed904fd2fe4ec3ea98687fc2de59ddf231

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

content-encoding: br
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
x-content-type-options: nosniff
expires: Thu, 12 Jun 2025 02:04:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 08 May 2025 23:15:48 GMT
cache-control: private, max-age=300
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
content-length: 6269
x-xss-protection: 0
server: sffe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame BAED 222 KB
68 KB 182ms
49ms Script
text/javascript 2607:f8b0:4004:c23::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14f332b6e901e2c2f2fd92d8053b444cdb4932b18c648071374b4ce81cdf1fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 4280537866323389757
age: 2764
x-content-type-options: nosniff
expires: Thu, 12 Jun 2025 02:18:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 12 Jun 2025 01:18:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69823
x-xss-protection: 0
server: cafe

GET
H2 200 notify
tlx.3lift.com/s2s/ Frame BAED 37 B
192 B 221ms
63ms Image
image/gif 34.192.42.219
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://tlx.3lift.com/s2s/notify?px=1&pr=aEo1nwAJ6n0DihkvAAZlFPPkxWOAGFZU8jAgTg&ts=1749693855&aid=45748663150760519318520&ec=8341_232840_579991283839122765&n=Gs8GaHR0cHM6Ly9hYXgtdXMtZWFzdC5hbWF6b24tYWRzeXN0ZW0uY29tL2UvaXMvNzEzMzc0MzY3NzM5N0EyNDQzMjY0NjI5NDg0MDRENjMvaW1wP2I9SkNvRkFLY3NjSTZwT0tWVmRmRzhRQWtBQUFHWFllRjRkUUVBQUFZT0FRQXpjSGhmZEhodVgySnBaRElnSUNBemNIaGZkSGh1WDJsdGNERWdJQ0E2V2hSMCZ3PTAuNTYmYmk9QXEuUjFYWVYwVWZ4TGRxM0t6LmhDNk5yT2tpM0VGazRQQXZQU3BYMVo3LVkwczJwdE45OVFYakdRNVcxQUxjb0lSLkZlbllha0lVS3FtLTNNOWNpVWEwSzRiUzhzcWtxLmhvLmdmWWd4Mm9BYmZOR1BicjdQU3FVM3BFRnJObk43V1c3UEo5N3R5dTdva2g3R2RtNFlzSExXLXJ0ay1UUlVQa3Zxb25Sc0Q4RlRvV1RQVllHVmVOdm5vT3ZibVBBTE9IWXJhYk4xNGlRS21MYTkxVkhvSlVGbkx0OXVnNG1uS2xkMnNvcW5IcDAtQXd6MVNCdkdxbnlteDNnYW1hZUpFZFc1aURkUERHV0lZcGpvLUR1OUtkcXlPOWZVbWhKWE8xM3g5T2FOeVhPcDlrOFhTR0xTQVdqdXJmdzZOZzZSa2RqSFhnSjVUTXNUUWlUSlFKak1mblprSVlPZlFEY2FlSjVVV0QyODV4WEM0WHhJN0ZwaS5jMk9rNFU5cEl4WjctRDBnT2V4bGdveFowOHpaQ2czb2hBN2t6SS55LVFZNEdIZVJIRXE0RVZLakVhbERzb2xuZ3R1WVVXVGxwOXFXM2ktQ0Vha3NzLjVyLURiTjdhcU9CSzc2LXhpNjJ1b2ZlLnM4QkxOdU1CT2ZNTFAtY2M0ZFNHVW9yeFo0eWItdkZtLXJlZjc4LUFvVHBoS2lmYS10NzFCTGtqNHRiWS1xOG5iZkpEVnBZenFVWGJUU0xTeFFnOGhEdm02Y0NxaHZwMVhlVldiaHc0eFhmUEYyM2FDSnlxSU1NUEJCRktwSGV4anN4a2FUV0FZTWE3WE45Qkczb0xydFhLaHk4TEI2LkVKb29nN2hybUxqTUNkVkxUN0FfX%2FICrwIIn%2BuowgYSFzQ1NzQ4NjYzMTUwNzYwNTE5MzE4NTIwGAAgASiVQTCImw5AAUgBUAFgCmgAcMDOAZABAJgBAKgBALgBCsAB1gPIAbAE8AEA%2BAGwBIAC1gORAgAAAAAAAPA%2FmQJ7FK5H4XrEP6gCALACAcgCBNgCAPgCwj2AA6ABiAPYBJADAJgDAKADAbgDya2HAcgDANIDEjU3OTk5MTI4MzgzOTEyMjc2NeADyc%2B2lgHpAwAAAAAAAAAA8AOwBPkDAAAAAAAAAACABAmJBFK4HoXrUcg%2FwATkAcoEHwgIGXsUrkfhesQ%2FIQAAAAAAAAAAKbgehetRuJ6%2FMADQBADaBBk0NTc0ODY2MzE1MDc2MDUxOTMxODUyMCAx4AQA8AQA%2BAQAiAWkgICAApAFl074AgWIAwCSAwRhejQ2mAMBoAOwiwKoAwC6AxYyNjAwOjgwMzphODg6MDowOjA6MDow2gMWChAWElhbN9s%2F7qdRt%2FbCzgxoEKD%2BCg%3D%3D
Requested by: Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.192.42.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-192-42-219.compute-1.amazonaws.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

expires: Thu, 15 Oct 1992 20:10:00 GMT
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
content-type: image/gif
vary: Accept-Encoding

GET

us
sync.go.sonobi.com/
Redirect Chain

https://id5-sync.com/i/483/8.gif?o=api&id5id=ID5*cODOrTXh5h06ZkMWPfVXH0YSdw9eiMWJbxK2mC9xouskInw5sFF404aAqBQNrgag&gdpr_consent=undefined&gdpr=false
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/483/108/7/2.gif?puid=e5afe47b-2841-4a97-bdcc-b86c67fc902c&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&ttl=%%TTL%%
https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F203%2F5%2F4.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/483/203/5/4.gif?puid=66047dc2-843a-4ad7-9fa9-e6971f9d7f1c&gdpr=0&gdpr_consent=
https://sync.ipredictive.com/d/sync/cookie/generic?partner=id5&cspid=18&cb=&redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F796%2F4%2F5.gif%3Fpuid%3D%24%7BADELPHIC_CUID%7D%26gdpr%3D0%26gdpr_consent...
https://id5-sync.com/c/483/796/4/5.gif?puid=6eb3f529-83d5-4e1e-8e01-397f6bb5f361&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F429%2F3%2F6.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/483/429/3/6.gif?puid=858D235C-4A6F-4842-B9AD-130DED726F58&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=27&3pid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&us_privacy=&gdpr=0&gdpr_consent=&location=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F1245%2F2%2F7.gif%3Fpuid%3D%5BSOVRNID%5D%...
https://id5-sync.com/c/483/1245/2/7.gif?puid=K0QcALZH9o9xtCUvTjO_8Qm9&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F483%2F434%2F1%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=

0
0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29F6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECqFQRm-IxwtQzQmd_ltQrA&google_cver=1

43 B
61 B

78ms
72ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECqFQRm-IxwtQzQmd_ltQrA&google_cver=1
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: no-cache, must-revalidate
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECqFQRm-IxwtQzQmd_ltQrA&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 295
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 29F6 170 B
188 B 109ms
84ms Image
image/png 172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NDYxODUzZjYtN2IwMy0yMTc1LWUzMTktOWViYTExNWQ2MmU3

Requested by

Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 29F6
Redirect Chain

https://match.adsrvr.org/track/cmf/openx?oxid=6a77803c-b274-7fd1-f6f9-c403dbbfac87&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

44ms
37ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: ffef7c53154b04a892ce1f9531c32cb1
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 12 Jun 2025 02:04:16 GMT
server: Kestrel

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29F6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/openx/feb0e678-22d8-ed98-c72e-d2f624e861ce?gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-IWq6yv1E2p9QXZl_8AYG5oSe2rSOZUXi7b0-~A

43 B
61 B

78ms
72ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-IWq6yv1E2p9QXZl_8AYG5oSe2rSOZUXi7b0-~A
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
vary: Accept

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://us-u.openx.net/w/1.0/sd?id=537073025&val=y-IWq6yv1E2p9QXZl_8AYG5oSe2rSOZUXi7b0-~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: ATS
x-frame-options: DENY

GET
H2

200

ny75r2x0
sync-tm.everesttech.net/ct/upi/pid/ Frame 29F6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aEo1oAAObQ2a9wA_

85 B
149 B

50ms
36ms

Image
image/png

151.101.66.49
FASTLY

General

Check archive.org

Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aEo1oAAObQ2a9wA_
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H2
Server: 151.101.66.49 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

x-robots-tag: noindex
cache-control: no-cache
x-timer: S1749693856.214092,VS0,VE0
age: 1307
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
x-cache: HIT
content-length: 85
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/png
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 2934

Redirect headers

x-robots-tag: noindex
cache-control: no-cache
location: https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=aEo1oAAObQ2a9wA_
x-timer: S1749693856.143958,VS0,VE7
pragma: no-cache
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
x-served-by: cache-ewr-kewr1740044-EWR
server: Jetty(9.4.35.v20201120)
x-cache-hits: 0

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 29F6
Redirect Chain

https://ad.turn.com/r/cs?pid=9&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537073061&val=3463038936866790899&gdpr=0&gdpr_consent=&us_privacy=

43 B
61 B

63ms
55ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3463038936866790899&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: playwire-d.openx.net
URL: https://playwire-d.openx.net/w/1.0/pd
Protocol: H3
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://playwire-d.openx.net/

Response headers

cache-control: private, max-age=0, no-cache
pragma: no-cache
x-forwarded-for: 206.66.99.143
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif
vary: Accept

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://us-u.openx.net/w/1.0/sd?id=537073061&val=3463038936866790899&gdpr=0&gdpr_consent=&us_privacy=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 12 Jun 2025 02:04:17 GMT

GET
H2 200 usync.js Show response
eus.rubiconproject.com/ Frame B11C 46 KB
0 73ms
73ms Script
text/html 23.50.125.215
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.50.125.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-50-125-215.deploy.static.akamaitechnologies.com
Software: Apache/2.4.62 (Debian) / PHP/8.3.13
Resource Hash: 0dfd0e87b108fd1adcf6393504749f73be23c6a5dea2236563bc619a89b05343

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/usync.html

Response headers

cache-control: max-age=48379
content-encoding: gzip
expires: Thu, 12 Jun 2025 15:30:34 GMT
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
content-length: 11651
date: Thu, 12 Jun 2025 02:04:15 GMT
last-modified: Wed, 11 Jun 2025 15:30:34 GMT
x-powered-by: PHP/8.3.13
server: Apache/2.4.62 (Debian)
content-type: text/html;charset=UTF-8
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame 1959
Redirect Chain

https://gum.criteo.com/sid/json?origin=criteoPrebidAdapter&domain=paint.toys&sn=ChromeSyncframe&so=0&topUrl=paint.toys&topicsavail=1&fledgeavail=1
https://mug.criteo.com/sid?cpp=iLUtinxkelcvelBzeU5iaXpJOU5mM28rTnNoQjRtRWI2eHBpdFp6M0Fjd091S093ZEEyYUJXazMzOGZLZm1vcE9vZnowdXZQakxpOGMzdUJEcWt4c2phK3NkaHp3ald2ZXRDOG13TVpvZWliN0xTekJ4TUc3WnZWRG9zc0...

1 KB
2 KB

55ms
35ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=iLUtinxkelcvelBzeU5iaXpJOU5mM28rTnNoQjRtRWI2eHBpdFp6M0Fjd091S093ZEEyYUJXazMzOGZLZm1vcE9vZnowdXZQakxpOGMzdUJEcWt4c2phK3NkaHp3ald2ZXRDOG13TVpvZWliN0xTekJ4TUc3WnZWRG9zc0xKdkl3OGR6OElvOWV6ZlY0emcxOC9XWnUzRmZhdzNUQlRzelJOT3ZiNnF5ZFFzZGhzckhPTTlNLzkwR01QcDhXdXJkemdhNXkwT2VlZkNzN1k2OEE3YU43Q2FlOEFhWW1CUXg0bEhheWJjOGFsWkVFQm1UVGZjZWh2M0N2WDBhbGM0aUVxYnhmbzRoSTRZY2gxSDNERWJxWTFxSVV6QWVISklWWlJjSjl6RU53Z1RUSW9TYlZ6d2lLWlJrZ0w3b3Q0ZTVtU1NtT3w&cppv=2

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

7b20fabf59e94b2e7a247d40f5d9fc9d941c43baefdb60c3b76fd4155f930732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://gum.criteo.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1096480
expires: 0
access-control-allow-origin: https://gum.criteo.com
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=iLUtinxkelcvelBzeU5iaXpJOU5mM28rTnNoQjRtRWI2eHBpdFp6M0Fjd091S093ZEEyYUJXazMzOGZLZm1vcE9vZnowdXZQakxpOGMzdUJEcWt4c2phK3NkaHp3ald2ZXRDOG13TVpvZWliN0xTekJ4TUc3WnZWRG9zc0xKdkl3OGR6OElvOWV6ZlY0emcxOC9XWnUzRmZhdzNUQlRzelJOT3ZiNnF5ZFFzZGhzckhPTTlNLzkwR01QcDhXdXJkemdhNXkwT2VlZkNzN1k2OEE3YU43Q2FlOEFhWW1CUXg0bEhheWJjOGFsWkVFQm1UVGZjZWh2M0N2WDBhbGM0aUVxYnhmbzRoSTRZY2gxSDNERWJxWTFxSVV6QWVISklWWlJjSjl6RU53Z1RUSW9TYlZ6d2lLWlJrZ0w3b3Q0ZTVtU1NtT3w&cppv=2
pragma: no-cache
server-processing-duration-in-ticks: 325852
expires: 0
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel

POST rum
btloader.com/cdn-cgi/ Frame 37B2 0
0

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 64ms
23ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 12 Jun 2025 02:04:15 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 205734
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 204 event Show response
p.ad.gt/api/v1/ 0
33 B 218ms
172ms XHR
text/plain 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: p.ad.gt
URL: https://p.ad.gt/api/v1/p/403
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://paint.toys/

Response headers

cf-ray: 94e5c6cb4d9ef797-EWR
access-control-allow-origin: https://paint.toys
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:16 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 281ms
131ms Preflight
text/html 2606:4700:10::6816:545
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:545 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://paint.toys
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://paint.toys
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 94e5c6ca3aabf797-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:16 GMT
server: cloudflare
vary: Origin

GET
H2 200 sync Show response
eb2.3lift.com/ Frame ADF0 1 KB
2 KB 52ms
33ms Document
text/html 52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: 005f4305bba628b0b72b463f2bec8f1fce2b31fe7fc002e2413859b6c5d89778

Request headers

Referer: https://paint.toys/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 1174
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:16 GMT
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

POST
H2 204 event
p.ad.gt/api/v1/ Frame 7738 0
140 B 291ms
147ms Ping
text/plain 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Requested by: Host: proton.ad.gt
URL: https://proton.ad.gt/join-ad-interest-groups.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: application/json
Referer: https://proton.ad.gt/

Response headers

cf-ray: 94e5c6cc1aed939a-EWR
access-control-allow-origin: https://proton.ad.gt
cf-cache-status: DYNAMIC
date: Thu, 12 Jun 2025 02:04:16 GMT
vary: Origin
server: cloudflare
access-control-allow-credentials: true

GET
H2

200

xuid
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=3658&xuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&dongle=0cfd&gdpr=0&gdpr_consent=

37 B
474 B

1031ms
1006ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3658&xuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:17 GMT
content-type: image/gif

Redirect headers

location: https://eb2.3lift.com/xuid?mid=3658&xuid=076b09a3-2210-4a56-beb0-1d4c9f4faecb&dongle=0cfd&gdpr=0&gdpr_consent=
content-length: 251
date: Thu, 12 Jun 2025 02:04:16 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFWB3aW1iD5s0oibYkE33sw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1

37 B
474 B

1015ms
991ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFWB3aW1iD5s0oibYkE33sw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:17 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEFWB3aW1iD5s0oibYkE33sw&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 332
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3F86
Redirect Chain

https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDMxNTAwNzc1NDIwNDg4NTYxMzc5OQ%3D%3D

170 B
188 B

60ms
57ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDMxNTAwNzc1NDIwNDg4NTYxMzc5OQ%3D%3D

Requested by

Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDMxNTAwNzc1NDIwNDg4NTYxMzc5OQ%3D%3D
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT

GET
H2

200

ebda
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=NDMxNTAwNzc1NDIwNDg4NTYxMzc5OQ%3D%3D
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=

37 B
139 B

96ms
79ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 248
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 200 setuid
px.ads.linkedin.com/ Frame 3F86 0
247 B 244ms
56ms Image
text/plain 2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=4315007754204885613799&dbredirect=true&gdpr=0&consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: BD0E39D72115455E991FE2307B8B7FCC Ref B: PHL30EDGE0222 Ref C: 2025-06-12T02:04:16Z
x-li-fabric: prod-lva1
x-li-uuid: AAY3VljHeKlew0usyp/kzw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT

GET
H2

200

sync
thrtle.com/ Frame 3F86
Redirect Chain

https://i.liadm.com/s/88342?bidder_id=246498&bidder_uuid=4315007754204885613799
https://thrtle.com/3012?sha256=595fd37f4e799db34e51168b09892501ac9bed5ec4c6a5439927300f0692655c&md5=ceb833da309876d2023efbe6a240fe3d&sha1=a85f495ac62fc46d31ff28f7f91cdd06ce532c74&us_privacy=1YN-&_t...
https://thrtle.com/12?_t=1749693856&mc=5730e83d-e224-4e52-8bdd-d2f2568dbc60&md5=ceb833da309876d2023efbe6a240fe3d&org_pid=3012&sha1=a85f495ac62fc46d31ff28f7f91cdd06ce532c74&sha256=595fd37f4e799db34e...
https://thrtle.com/sync?vxii_pid=12&dt=1749693856&vxii_rmax=3
https://cms.analytics.yahoo.com/cms?partner_id=THROTLE
https://ups.analytics.yahoo.com/ups/58691/cms?partner_id=THROTLE
https://thrtle.com/sync?vxii_pid=5038&vxii_pdid=y-yRG3iHlE2oQW7bE6IxvY8S99Xys2GIyj7zikYw--~A
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc1MDYwNzE3Ni90LzA/dpuid/5730e83d-e224-4e52-8bdd-d2f2568dbc60/url/https://thrtle.com/sync?vxii_pid=5046&vxii_pdid=$!{TURN_UUID}&t=1531451857
https://thrtle.com/sync?vxii_pid=5046&vxii_pdid=3463038936866790899&t=1531451857
https://match.adsrvr.org/track/cmf/generic?ttd_pid=brgeu23&ttd_tpi=1&TTD_PUID=5730e83d-e224-4e52-8bdd-d2f2568dbc60
https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb

43 B
538 B

37ms
36ms

Image
image/gif

44.217.241.107
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 44.217.241.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-217-241-107.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

p3p: CP="NOI OUR BUS UNI COM NAV"
content-length: 43
date: Thu, 12 Jun 2025 02:04:17 GMT
content-type: image/gif

Redirect headers

location: https://thrtle.com/sync?vxii_pid=5015&vxii_pdid=076b09a3-2210-4a56-beb0-1d4c9f4faecb
content-length: 199
date: Thu, 12 Jun 2025 02:04:17 GMT
server: Kestrel

GET
H2

200

xuid
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/triplelift/4315007754204885613799?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=2662&xuid=y-ZmZ4Ch9E2oTHKvEpIT6PpNyKCwHQWKF.c3hZ3vMfIA--~A&dongle=0883

37 B
474 B

49ms
31ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2662&xuid=y-ZmZ4Ch9E2oTHKvEpIT6PpNyKCwHQWKF.c3hZ3vMfIA--~A&dongle=0883
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://eb2.3lift.com/xuid?mid=2662&xuid=y-ZmZ4Ch9E2oTHKvEpIT6PpNyKCwHQWKF.c3hZ3vMfIA--~A&dongle=0883
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: ATS
x-frame-options: DENY

GET
H2 200 c.gif
c.bing.com/ Frame 3F86 42 B
690 B 243ms
33ms Image
image/gif 2620:1ec:33:1::10
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://c.bing.com/c.gif?xid=4315007754204885613799&Red3=TLMS_pd
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: private, no-cache, proxy-revalidate, no-store
pragma: no-cache
etag: "9550854666d9db1:0"
x-msedge-ref: Ref A: 5C6AD30EA6CD4F06A558FF1E0D459B36 Ref B: PHL30EDGE0211 Ref C: 2025-06-12T02:04:16Z
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 42
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: image/gif
last-modified: Mon, 09 Jun 2025 17:45:23 GMT
x-powered-by: ASP.NET

GET
H2

200

xuid
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://triplelift-match.dotomi.com/match/bounce/current?networkId=74572&version=1&gdpr=0&gdpr_consent=
https://triplelift-match.dotomi.com/match/bounce/current?DotomiTest=3e3d7f90fd590526&is_secure=true&networkId=74572&version=1&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADOONY0xcRywJGHXrLAQEBAQEBAQCWYOB6QAEBAQEBAQEB&expiration=1749780256&is_secure=true&gdpr_consent=&gdpr=0

37 B
474 B

63ms
41ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADOONY0xcRywJGHXrLAQEBAQEBAQCWYOB6QAEBAQEBAQEB&expiration=1749780256&is_secure=true&gdpr_consent=&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

expires: 0
cache-control: no-cache, private, max-age=0, no-store
location: https://eb2.3lift.com/xuid?mid=6732&dongle=38F&xuid=AQADOONY0xcRywJGHXrLAQEBAQEBAQCWYOB6QAEBAQEBAQEB&expiration=1749780256&is_secure=true&gdpr_consent=&gdpr=0
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
pragma: no-cache
server: nginx

GET
H2

200

xuid
eb2.3lift.com/ Frame 3F86
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=13&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://eb2.3lift.com/xuid?mid=2319&xuid=0-682750eb-f2b1-5981-595f-737d07eb91a5$ip$206.66.99.143&dongle=4430

37 B
474 B

50ms
21ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2319&xuid=0-682750eb-f2b1-5981-595f-737d07eb91a5$ip$206.66.99.143&dongle=4430
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

Location: https://eb2.3lift.com/xuid?mid=2319&xuid=0-682750eb-f2b1-5981-595f-737d07eb91a5$ip$206.66.99.143&dongle=4430
Content-Length: 139
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

OPTIONS
H2 200 event
p.ad.gt/api/v1/ Frame 0
0 277ms
132ms Preflight
text/html 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://p.ad.gt/api/v1/event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://proton.ad.gt
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin: https://proton.ad.gt
allow: OPTIONS, POST
cf-cache-status: DYNAMIC
cf-ray: 94e5c6ca7f8d97b2-EWR
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 12 Jun 2025 02:04:16 GMT
server: cloudflare
vary: Origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
281 B 162ms
110ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

Resource Hash

633311f392df0a2b97c6e02247be3bed7044aceb4eee67befaf8a63d2e8e4eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://paint.toys
date: Thu, 12 Jun 2025 02:04:15 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame B51A 0
792 B 178ms
152ms Script
text/html 68.67.179.166
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.179.166 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://acdn.adnxs.com/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 206.66.99.143; 206.66.99.143; 575.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 1fb19520-576d-47c0-b421-bf1d7253778c
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://match.prod.bidr.io/cookie-sync/trl?gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=7255&xuid=AADmi07QlGsAABqcWCFGIQ&dongle=bzwx&gdpr=0

37 B
474 B

61ms
43ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7255&xuid=AADmi07QlGsAABqcWCFGIQ&dongle=bzwx&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://eb2.3lift.com/xuid?mid=7255&xuid=AADmi07QlGsAABqcWCFGIQ&dongle=bzwx&gdpr=0
Content-Length: 0
Date: Thu, 12 Jun 2025 02:04:16 GMT
Server: gunicorn
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame ADF0 43 B
1 KB 188ms
39ms Image
image/gif 3.210.179.24
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=20&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.179.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-179-24.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H/1.1 200
OK sync
sync.srv.stackadapt.com/ Frame ADF0 43 B
1 KB 183ms
37ms Image
image/gif 3.210.179.24
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://sync.srv.stackadapt.com/sync?nid=114&gdpr=0&gdpr_consent=&gpp=&gpp_sid=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.179.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-179-24.compute-1.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

Content-Length: 43
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: image/gif
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?https://eb2.3lift.com/xuid?mid=3702&xuid=${ADELPHIC_CUID}&dongle=d54f&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=3702&xuid=6eb3f529-83d5-4e1e-8e01-397f6bb5f361&dongle=d54f&gdpr=0&gdpr_consent=

37 B
474 B

62ms
43ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3702&xuid=6eb3f529-83d5-4e1e-8e01-397f6bb5f361&dongle=d54f&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

X-CI-RTID: cbf54527-2051-4eab-b5b7-83ac299d8890
Location: https://eb2.3lift.com/xuid?mid=3702&xuid=6eb3f529-83d5-4e1e-8e01-397f6bb5f361&dongle=d54f&gdpr=0&gdpr_consent=
Content-Length: 149
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=83&gdpr=0&gdpr_consent=
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=83&gdpr=0&gdpr_consent=
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=312397ab-2935-4591-9536-f00b9676f1c6-684a35a0-5553&gdpr=0&gdpr_consent=&d=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Fpush%3Fpartner_id%3D2499%...
https://pixel.tapad.com/idsync/ex/push?partner_id=2499&partner_device_id=312397ab-2935-4591-9536-f00b9676f1c6-684a35a0-5553&partner_url=https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3646%26xuid%3D3123...
https://eb2.3lift.com/xuid?mid=3646&xuid=312397ab-2935-4591-9536-f00b9676f1c6-684a35a0-5553&dongle=1fa5&gdpr=0&gdpr_consent=

37 B
474 B

36ms
35ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=3646&xuid=312397ab-2935-4591-9536-f00b9676f1c6-684a35a0-5553&dongle=1fa5&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:17 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
location: https://eb2.3lift.com/xuid?mid=3646&xuid=312397ab-2935-4591-9536-f00b9676f1c6-684a35a0-5553&dongle=1fa5&gdpr=0&gdpr_consent=
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via: 1.1 google
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: Jetty(11.0.25)

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://x.bidswitch.net/sync?ssp=triplelift&user_id=4315007754204885613799&gdpr=0&gdpr_consent=
https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=triplelift&bsw_custom_parameter=167a889f-aba5-4900-af59-559ea01d3c06
https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=330e0fa9-0c78-450b-a338-cae0f41f4c5d&ssp=triplelift&bsw_param=167a889f-aba5-4900-af59-559ea01d3c06
https://eb2.3lift.com/xuid?mid=2409&xuid=167a889f-aba5-4900-af59-559ea01d3c06&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=

37 B
474 B

43ms
31ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2409&xuid=167a889f-aba5-4900-af59-559ea01d3c06&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //eb2.3lift.com/xuid?mid=2409&xuid=167a889f-aba5-4900-af59-559ea01d3c06&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:16 GMT

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://ad.turn.com/r/cs?pid=49&gdpr=0&gdpr_consent=
https://eb2.3lift.com/xuid?mid=4771&xuid=3463038936866790899&dongle=d407&gdpr=0&gdpr_consent=

37 B
474 B

63ms
44ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=4771&xuid=3463038936866790899&dongle=d407&gdpr=0&gdpr_consent=
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://eb2.3lift.com/xuid?mid=4771&xuid=3463038936866790899&dongle=d407&gdpr=0&gdpr_consent=
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 12 Jun 2025 02:04:35 GMT

GET 757c0557066e95cfd4c7
s.amazon-adsystem.com/x/ Frame ADF0 0
0

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=
https://b1sync.outbrain.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&s=2
https://b1sync.zemanta.com/usersync/triplelift/?gdpr=0&gdpr_consent=&gpp=&gpp_sid=&obuid=f55ce21a-1872-448c-8d14-a9f9e57a143f&s=2
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=f55ce21a-1872-448c-8d14-a9f9e57a143f&gdpr=0

37 B
474 B

36ms
35ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=f55ce21a-1872-448c-8d14-a9f9e57a143f&gdpr=0
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=f55ce21a-1872-448c-8d14-a9f9e57a143f&gdpr=0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 131
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html; charset=utf-8

GET
H2

200

xuid
eb2.3lift.com/ Frame ADF0
Redirect Chain

https://um.simpli.fi/triplelift
https://eb2.3lift.com/xuid?mid=7969&xuid=B18E03F17B1E453DA42531E9D32A73D9&dongle=yf3

37 B
474 B

59ms
44ms

Image
image/gif

52.223.22.214
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7969&xuid=B18E03F17B1E453DA42531E9D32A73D9&dongle=yf3
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H2
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: image/gif

Redirect headers

strict-transport-security: max-age=63072000; includeSubdomains; preload
cache-control: no-cache
location: https://eb2.3lift.com/xuid?mid=7969&xuid=B18E03F17B1E453DA42531E9D32A73D9&dongle=yf3
x-content-type-options: nosniff
access-control-allow-methods: GET, POST, OPTIONS
expires: Wed, 11 Jun 2025 02:04:16 GMT
access-control-allow-origin: *
content-length: 142
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html
server: openresty
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

GET
H3 200 setuid
prebid.intergient.com/ Frame ADF0 0
974 B 73ms
62ms Image
text/html 2606:4700::6812:1438
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://prebid.intergient.com/setuid?bidder=triplelift&gdpr=&gdpr_consent=&gpp=&gpp_sid=&f=b&uid=4315007754204885613799
Requested by: Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?gdpr=&cmp_cs=&us_privacy=&gpp=&gpp_sid=&redir=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Dtriplelift%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%24UID
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:1438 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eb2.3lift.com/

Response headers

content-encoding: br
cf-cache-status: DYNAMIC
report-to: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1749693856&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=jyi3jkRMxp%2FnaW6PcR2lRLgcy0%2BIXAd0GQaEP1kYgKE%3D"}]}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html
vary: Origin
priority: u=3,i
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1749693856&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&s=jyi3jkRMxp%2FnaW6PcR2lRLgcy0%2BIXAd0GQaEP1kYgKE%3D
nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
via: 1.1 vegur
cf-ray: 94e5c6ca0f470f9d-EWR
server: cloudflare

GET
H2 200 bundle.js Show response
ib.3lift.com/rev/4a82bc57e1bd5bc08b3cf0ae40f490e1e67308aa/dist/ Frame BAED 258 KB
71 KB 75ms
47ms Script
text/javascript 2600:9000:2807:1200:d:c38f:29c0:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ib.3lift.com/rev/4a82bc57e1bd5bc08b3cf0ae40f490e1e67308aa/dist/bundle.js
Requested by: Host: ib.3lift.com
URL: https://ib.3lift.com/ttj?inv_code=pwm_general_RON_hdx
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2807:1200:d:c38f:29c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e96f489a82024a1cba1f5dc190381013e159bc183f345459e0f8ced3ff612b00

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/

Response headers

vary: accept-encoding
cache-control: max-age=31536000, immutable
content-encoding: br
etag: W/"b5b763d06d7286df257ef90b3a94bb19"
age: 44969
via: 1.1 dda48093758850ff13b7c87654612728.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Y6D92Zj9Lb-NUaHgOiQL97H-egdVHPM72jiOQOHVPfa93tmOpD_nhg==
date: Wed, 11 Jun 2025 13:34:48 GMT
content-type: text/javascript
last-modified: Wed, 11 Jun 2025 13:31:14 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P6
x-amz-server-side-encryption: AES256

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8BDF 1 KB
643 B 52ms
40ms Document
text/html 2607:f8b0:4004:c23::9a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c23::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

Response headers

age: 74523
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 11 Jun 2025 05:22:13 GMT
etag: 48472445140208031
expires: Thu, 12 Jun 2025 05:22:13 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://x.bidswitch.net/sync?ssp=criteo&custom_data=i1asl19BOURma3lNNUVQODlRa1VDWVdiQlo2cjRaJTJCeHlrajR1QUlBM1hxcGFueUUlM0Q&gpp=&gpp_sid=&gdpr=0&gdpr_consent=&us_privacy=&cr_user_id=k-0MxWGIMRLbpWa...
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=167a889f-aba5-4900-af59-559ea01d3c06&ssp=criteo&gdpr=0&gdpr_consent=
https://global.ib-ibi.com/image.sbmx?go=298769&pid=541&xid=10610410355518715501&ssp=criteo&gdpr=0&gdpr_consent=
https://ib.mookie1.com/image.sbmx?go=298769&pid=541&xid=10610410355518715501&ssp=criteo&gdpr=0&gdpr_consent=
https://odr.mookie1.com/t/v2?tagid=V2_948118&src.visitorid=&ssp=criteo
https://x.bidswitch.net/sync?dsp_id=419&user_id=10610410355518715501&ssp=criteo&gdpr=&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=&u=167a889f-aba5-4900-af59-559ea01d3c06

0
141 B

33ms
33ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=&u=167a889f-aba5-4900-af59-559ea01d3c06

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 12 Jun 2025 02:04:16 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

via: 1.1 google
cache-control: no-cache, no-store, must-revalidate
location: //ssp-sync.criteo.com/user-sync/match?p=&u=167a889f-aba5-4900-af59-559ea01d3c06
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 12 Jun 2025 02:04:17 GMT

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://secure.adnxs.com/getuid?https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3do1eVG19WY0JEN1FrVkc2OElwOHBCJTJGMWVYb2tOQnhFVGxIRHJBaXpscmxBWXhZWnclM0Q%26u%3d%24UID&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/match?p=o1eVG19WY0JEN1FrVkc2OElwOHBCJTJGMWVYb2tOQnhFVGxIRHJBaXpscmxBWXhZWnclM0Q&u=315100540158048298&gdpr=0&gdpr_consent=

0
142 B

200ms
70ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=o1eVG19WY0JEN1FrVkc2OElwOHBCJTJGMWVYb2tOQnhFVGxIRHJBaXpscmxBWXhZWnclM0Q&u=315100540158048298&gdpr=0&gdpr_consent=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 12 Jun 2025 02:04:15 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-store, no-cache, private
location: https://ssp-sync.criteo.com/user-sync/match?p=o1eVG19WY0JEN1FrVkc2OElwOHBCJTJGMWVYb2tOQnhFVGxIRHJBaXpscmxBWXhZWnclM0Q&u=315100540158048298&gdpr=0&gdpr_consent=
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 206.66.99.143; 206.66.99.143; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: ba309736-f5f8-4a6f-84ab-650764089a64
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

GET
H2

204

match
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=commerce_grid_dbm&google_hm=k-0MxWGIMRLbpWamgr1TVG6ZvxXsl_IXJRUvIvFA&google_cm&google_redir=https%3a%2f%2fssp-sync.criteo.com%2fuser-sync%2fmatch%3fp%3...
https://ssp-sync.criteo.com/user-sync/match?p=I8sNEV9HZXRNMTlrZmhad01jeGY1U1FyZjFNTVIyJTJGUzdHQVNvcCUyRmJpUnJjSkZTMCUzRA&u=CAESEJAX6HEI0YTulpTil7TK8kM&gdpr=0&gdpr_consent=&google_cver=1

0
141 B

181ms
72ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/match?p=I8sNEV9HZXRNMTlrZmhad01jeGY1U1FyZjFNTVIyJTJGUzdHQVNvcCUyRmJpUnJjSkZTMCUzRA&u=CAESEJAX6HEI0YTulpTil7TK8kM&gdpr=0&gdpr_consent=&google_cver=1

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
date: Thu, 12 Jun 2025 02:04:16 GMT
cross-origin-resource-policy: cross-origin
server: Kestrel

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ssp-sync.criteo.com/user-sync/match?p=I8sNEV9HZXRNMTlrZmhad01jeGY1U1FyZjFNTVIyJTJGUzdHQVNvcCUyRmJpUnJjSkZTMCUzRA&u=CAESEJAX6HEI0YTulpTil7TK8kM&gdpr=0&gdpr_consent=&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 398
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

bidder-initiated
ssp-sync.criteo.com/user-sync/
Redirect Chain

https://ad.turn.com/r/cs?pid=75&us_privacy=&gdpr=0&gdpr_consent=
https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3463038936866790899

0
144 B

154ms
70ms

Image
text/plain

2620:100:a00b::28
AS-CRITEO

General

Check archive.org

Download Go to Show image

Full URL

https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3463038936866790899

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

2620:100:a00b::28 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-store,max-age=0
content-length: 0
date: Thu, 12 Jun 2025 02:04:15 GMT
server: Kestrel
cross-origin-resource-policy: cross-origin

Redirect headers

cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
location: https://ssp-sync.criteo.com/user-sync/bidder-initiated?gdpr_consent=&gdpr=0&us_privacy=&dsp=11&buyer_id=3463038936866790899
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
content-length: 0
pragma: no-cache
date: Thu, 12 Jun 2025 02:04:33 GMT

GET
DATA 200
OK truncated
/ Frame BAED 212 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c4fcf5bd91ba5d3cd3752959717bad452ba5a746b1ba3a1da8d80c87bb5b4cc5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame B4B3 7 B
1 KB 197ms
41ms XHR
application/json 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
access-control-allow-credentials: true
Expires: 0
access-control-allow-origin: https://eus.rubiconproject.com
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 84e0f527cd81a00b0210e20b4ee7ed94
content-length: 7
content-type: application/json; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_push=AXcoOmQdcFI6MkjAknp80V6dOiqgMd5szwq58_X3rXELTd8suqwq8LBOwEqoOoVpn_2kgneQOx7pMcu8V5njIIY-FrWQV0mtt1n92w
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=_v9LBgPISg8b-ov3YBtmkw&google_push=AXcoOmQdcFI6MkjAknp80V6dOiqgMd5szwq58_X3rXELTd8suqwq8LBOwEqoOoVpn_2kgneQOx7pMcu8V5njIIY-FrWQV0mtt1n92w

170 B
188 B

52ms
46ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=_v9LBgPISg8b-ov3YBtmkw&google_push=AXcoOmQdcFI6MkjAknp80V6dOiqgMd5szwq58_X3rXELTd8suqwq8LBOwEqoOoVpn_2kgneQOx7pMcu8V5njIIY-FrWQV0mtt1n92w

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=_v9LBgPISg8b-ov3YBtmkw&google_push=AXcoOmQdcFI6MkjAknp80V6dOiqgMd5szwq58_X3rXELTd8suqwq8LBOwEqoOoVpn_2kgneQOx7pMcu8V5njIIY-FrWQV0mtt1n92w
x-host: tde-deliveryengine-production-b75bf498c-k4ggp
via: 1.1 google
x-engine-version: 0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
date: Thu, 12 Jun 2025 02:04:16 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://a.c.appier.net/gcm?google_push=AXcoOmTCfyrC-wMzDnMsR1aQBicuPNkakSU1R0XJ1TF6U7lboKlkkgxFQjN5kbErnpTvp-Us5wbcMCRfSlSufNSH1jILFWq_DWUw4Q
https://cm.g.doubleclick.net/pixel?google_hm=OVdhMkRCcVZCWUNJX2pBSm9UVkthQQ%3D%3D&google_nid=appier&google_push=AXcoOmTCfyrC-wMzDnMsR1aQBicuPNkakSU1R0XJ1TF6U7lboKlkkgxFQjN5kbErnpTvp-Us5wbcMCRfSlSuf...

170 B
188 B

48ms
47ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=OVdhMkRCcVZCWUNJX2pBSm9UVkthQQ%3D%3D&google_nid=appier&google_push=AXcoOmTCfyrC-wMzDnMsR1aQBicuPNkakSU1R0XJ1TF6U7lboKlkkgxFQjN5kbErnpTvp-Us5wbcMCRfSlSufNSH1jILFWq_DWUw4Q

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:17 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-store
Location: https://cm.g.doubleclick.net/pixel?google_hm=OVdhMkRCcVZCWUNJX2pBSm9UVkthQQ%3D%3D&google_nid=appier&google_push=AXcoOmTCfyrC-wMzDnMsR1aQBicuPNkakSU1R0XJ1TF6U7lboKlkkgxFQjN5kbErnpTvp-Us5wbcMCRfSlSufNSH1jILFWq_DWUw4Q
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 12 Jun 2025 02:04:17 GMT
Server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://tr-us.adsmoloco.com/pm?google_push=AXcoOmQ7OxK9xbzlCP2eKhuUJZE9BKjap0-ac3L3B4PRUYd-VpuuPV2HEckjSxtnZ7jJFT-m5FY6cqz4MvsWgIzdfb9WGnDxB1gH
https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=YSJ9YxIXSwGEuvILUAk9TA&google_push=AXcoOmQ7OxK9xbzlCP2eKhuUJZE9BKjap0-ac3L3B4PRUYd-VpuuPV2HEckjSxtnZ7jJFT-m5FY6cqz4MvsWgIzdfb9WGnD...

170 B
188 B

51ms
46ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=YSJ9YxIXSwGEuvILUAk9TA&google_push=AXcoOmQ7OxK9xbzlCP2eKhuUJZE9BKjap0-ac3L3B4PRUYd-VpuuPV2HEckjSxtnZ7jJFT-m5FY6cqz4MvsWgIzdfb9WGnDxB1gH

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
location: https://cm.g.doubleclick.net/pixel?google_nid=moloco_ads&google_hm=YSJ9YxIXSwGEuvILUAk9TA&google_push=AXcoOmQ7OxK9xbzlCP2eKhuUJZE9BKjap0-ac3L3B4PRUYd-VpuuPV2HEckjSxtnZ7jJFT-m5FY6cqz4MvsWgIzdfb9WGnDxB1gH
content-length: 233
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_push=AXcoOmTwcvvLXwtBr2EW65BNw5jvxx_R0fJBm17Y0MKCXXDoSUpKKiN3Z8156gw7AnxsW4FlLtov01IEHql3NmeFiCicW6aoA5Zh
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=AXcoOmTwcvvLXwtBr2EW65BNw5jvxx_R0fJBm17Y0MKCXXDoSUpKKiN3Z8156gw7AnxsW4FlLtov01IEHql3NmeFiCicW6aoA5Zh

170 B
188 B

82ms
75ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=AXcoOmTwcvvLXwtBr2EW65BNw5jvxx_R0fJBm17Y0MKCXXDoSUpKKiN3Z8156gw7AnxsW4FlLtov01IEHql3NmeFiCicW6aoA5Zh

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=AXcoOmTwcvvLXwtBr2EW65BNw5jvxx_R0fJBm17Y0MKCXXDoSUpKKiN3Z8156gw7AnxsW4FlLtov01IEHql3NmeFiCicW6aoA5Zh
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 382e2818ca015d35b02cd449aa60881d
content-length: 0
Content-Type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=&google_push=AXcoOmTv9z7Z6Jmz6PxgaBab5azvboAX64Bl5yyoXzTtWDgbPjL9c0BFHZ5DjHd0nXKUOMN6OTAaxZbkjrt7zEVWyoYBUosmeFE04g
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=M2FkZTI5ZjJmZjQ2NGE2Nzk5N2JmYTdhMDNiNzNmZmI%3D&UIDF=&google_push=AXcoOmTv9z7Z6Jmz6PxgaBab5azvboAX64Bl5yyoXzTtWDgbPjL9c0BFHZ5DjHd0nXKUO...

170 B
188 B

57ms
47ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=M2FkZTI5ZjJmZjQ2NGE2Nzk5N2JmYTdhMDNiNzNmZmI%3D&UIDF=&google_push=AXcoOmTv9z7Z6Jmz6PxgaBab5azvboAX64Bl5yyoXzTtWDgbPjL9c0BFHZ5DjHd0nXKUOMN6OTAaxZbkjrt7zEVWyoYBUosmeFE04g

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=M2FkZTI5ZjJmZjQ2NGE2Nzk5N2JmYTdhMDNiNzNmZmI%3D&UIDF=&google_push=AXcoOmTv9z7Z6Jmz6PxgaBab5azvboAX64Bl5yyoXzTtWDgbPjL9c0BFHZ5DjHd0nXKUOMN6OTAaxZbkjrt7zEVWyoYBUosmeFE04g
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 12 Jun 2025 02:04:16 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://beacon.lynx.cognitivlabs.com/adx.gif?google_push=AXcoOmQmNgCSV5H0HgovnIxZ67I7pVJUnNpXeaFzdZgqbVZg0ImoenTE2u6ANbKW0uobVLmtwLxHwO9CV5K0_pYJBhG8qdNXlQHQQA
https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=hWdplS4rI0eGVR_rqs8R6w&google_push=AXcoOmQmNgCSV5H0HgovnIxZ67I7pVJUnNpXeaFzdZgqbVZg0ImoenTE2u6ANbKW0uobVLmtwLxHwO9CV5K0_pYJBhG8qdNXl...

170 B
188 B

78ms
72ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=hWdplS4rI0eGVR_rqs8R6w&google_push=AXcoOmQmNgCSV5H0HgovnIxZ67I7pVJUnNpXeaFzdZgqbVZg0ImoenTE2u6ANbKW0uobVLmtwLxHwO9CV5K0_pYJBhG8qdNXlQHQQA

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=cognitiv&google_hm=hWdplS4rI0eGVR_rqs8R6w&google_push=AXcoOmQmNgCSV5H0HgovnIxZ67I7pVJUnNpXeaFzdZgqbVZg0ImoenTE2u6ANbKW0uobVLmtwLxHwO9CV5K0_pYJBhG8qdNXlQHQQA
Content-Length: 0
Date: Thu, 12 Jun 2025 02:04:16 GMT
Connection: keep-alive
Server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8BDF
Redirect Chain

https://www.temu.com/api/adx/cm/pixel-google?google_push=AXcoOmQnYW3Q1cPAWWwEHCq-yn79lysTekb8JcdNAYBq56YwA-dB7BxAd23Y1CltDQDPwKhZtJy0eGTrYQ_tw2eYvAVNvI58M4jPPd0
https://cm.g.doubleclick.net/pixel?google_push=AXcoOmQnYW3Q1cPAWWwEHCq-yn79lysTekb8JcdNAYBq56YwA-dB7BxAd23Y1CltDQDPwKhZtJy0eGTrYQ_tw2eYvAVNvI58M4jPPd0&google_nid=temu_dsp2_

170 B
188 B

60ms
53ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_push=AXcoOmQnYW3Q1cPAWWwEHCq-yn79lysTekb8JcdNAYBq56YwA-dB7BxAd23Y1CltDQDPwKhZtJy0eGTrYQ_tw2eYvAVNvI58M4jPPd0&google_nid=temu_dsp2_

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000
yak-timeinfo: 1749693856576|3
location: https://cm.g.doubleclick.net/pixel?google_push=AXcoOmQnYW3Q1cPAWWwEHCq-yn79lysTekb8JcdNAYBq56YwA-dB7BxAd23Y1CltDQDPwKhZtJy0eGTrYQ_tw2eYvAVNvI58M4jPPd0&google_nid=temu_dsp2_
content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gif
x-gateway-request-id: 1749693856576-8f9d865b0e1849adeb9eb6a99179576c-20
cip: 206.66.99.143
alt-svc: h3=":443"; ma=604800
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: nginx

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8BDF 0
12 B 70ms
64ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KviVsjiou_ABfxG-tLdweiOwVTu6bHDIx5gjjMeH37gHqC-5fafuguT7xqBv0bpNTV6alHw98

Requested by

Host: 91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com
URL: https://91f4630daabf8827925f0c102eb105aa.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

POST
H2 200 483.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 173ms
134ms Fetch
application/json 162.19.138.118
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/483.json

Requested by

Host: cdn.intergient.com
URL: https://cdn.intergient.com/prebid/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

Resource Hash

ccec53f86ab2c87c97390acbd7a722e9d9910c4ecaa301ab1fbb0011ef9d2d5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://paint.toys
p3p: CP="CAO PSA OUR"
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/json
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

POST
H3 204 ping
pagead2.googlesyndication.com/pagead/ 0
0 148ms
52ms Fetch
text/html 2607:f8b0:4004:c23::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202506110101/pubads_impl.js?cb=31092945
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4004:c23::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://paint.toys/

Response headers

GET
H2

200

cs
cs.yellowblue.io/ Frame B4B3
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&khaos=MBSQJMTR-7-CU07
https://cs.yellowblue.io/cs?aid=11590&id=MBSQJMTR-7-CU07

0
355 B

38ms
34ms

Image
application/javascript

54.225.22.192
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://cs.yellowblue.io/cs?aid=11590&id=MBSQJMTR-7-CU07
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: H2
Server: 54.225.22.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-22-192.compute-1.amazonaws.com
Software: istio-envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

access-control-expose-headers: X-Reason
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin: https://eus.rubiconproject.com/
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
content-type: application/javascript
server: istio-envoy
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF, X-Requested-With

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cs.yellowblue.io/cs?aid=11590&id=MBSQJMTR-7-CU07
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 44e748b6247b033344ab4f6b8c0f8cbb
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame B4B3
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=a9us
https://s.amazon-adsystem.com/ecm3?id=MBSQJMTR-7-CU07&ex=d-rubiconproject.com&status=ok

43 B
479 B

193ms
85ms

Image
image/gif

98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?id=MBSQJMTR-7-CU07&ex=d-rubiconproject.com&status=ok

Requested by

Protocol

HTTP/1.1

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: PTCVKW9QRNCDCY793725
Content-Length: 43
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://s.amazon-adsystem.com/ecm3?id=MBSQJMTR-7-CU07&ex=d-rubiconproject.com&status=ok
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B4B3
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30

42 B
1 KB

35ms
32ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f69a50991384d09413b97a37bb74928b
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=076b09a3-2210-4a56-beb0-1d4c9f4faecb&gdpr=0&gdpr_consent=&expires=30
content-length: 289
date: Thu, 12 Jun 2025 02:04:16 GMT
server: Kestrel

GET
H/1.1 200
OK dcm
aax-eu.amazon-adsystem.com/s/ Frame B4B3 43 B
855 B 595ms
290ms Image
image/gif 52.95.115.255
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.95.115.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: SYWJM4CCXDVNKK4ZC253
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 12 Jun 2025 02:04:17 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B4B3
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TUJTUUpNVFItNy1DVTA3
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESENjFAEUE1SYYsAMIivf0tzk&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=

170 B
188 B

48ms
46ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-98-82-158-241.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-cache,no-store,must-revalidate
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TUJTUUpNVFItNy1DVTA3&google_push=
Pragma: no-cache
Expires: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 19ea072139d67f7022c6e463249c998e
content-length: 0
Content-Type: text/html

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B4B3
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/R28sl6G7D9UadKFt--h9YQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_CLaBsFE2oJsPCGZ_RMjcl_A30ROlU0lwlBF3A--~A

42 B
1 KB

65ms
33ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_CLaBsFE2oJsPCGZ_RMjcl_A30ROlU0lwlBF3A--~A
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f84b118a3f01dd6ffa744f6af941f4e8
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=dsp
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-_CLaBsFE2oJsPCGZ_RMjcl_A30ROlU0lwlBF3A--~A
age: 0
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT
server: ATS
x-frame-options: DENY

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame B4B3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&process_consent=T
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDBTy6u-AKtKBv7g-uLGE38&google_cver=1

42 B
1 KB

86ms
47ms

Image
image/gif

69.173.151.100
RUBICONPROJECT

General

Check archive.org

Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDBTy6u-AKtKBv7g-uLGE38&google_cver=1
Requested by: Host: pbs-cs.yellowblue.io
URL: https://pbs-cs.yellowblue.io/pbs-iframe?gdpr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=&redirect=https%3A%2F%2Fprebid.intergient.com%2Fsetuid%3Fbidder%3Drise%26gdpr%3D%26gdpr_consent%3D%26gpp%3D%26gpp_sid%3D%26f%3Db%26uid%3D%5BPBS_UID%5D
Protocol: HTTP/1.1
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: f72efbd84733ea5ba734e4e8fe0395a3
Pragma: no-cache
content-length: 42
Content-Type: image/gif

Redirect headers

cache-control: no-cache, must-revalidate
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEDBTy6u-AKtKBv7g-uLGE38&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 326
date: Thu, 12 Jun 2025 02:04:16 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

setuid
px.ads.linkedin.com/ Frame B4B3
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MBSQJMTR-7-CU07

0
143 B

49ms
48ms

Image
text/plain

2620:1ec:50::12
MICROSOFT-CORP-MS...

General

Check archive.org

Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MBSQJMTR-7-CU07
Requested by: Host: paint.toys
URL: https://paint.toys/oil/
Protocol: H2
Server: 2620:1ec:50::12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 1DD91ECA87474316A521DB72EA2B68F3 Ref B: PHL30EDGE0222 Ref C: 2025-06-12T02:04:16Z
x-li-fabric: prod-lva1
x-li-uuid: AAY3VljOwZWy64Rz71r/Hg==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Thu, 12 Jun 2025 02:04:16 GMT

Redirect headers

Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=MBSQJMTR-7-CU07
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 0228ab361cece0438ff9eb16e4e5890e
Pragma: no-cache
content-length: 0

GET
H/1.1 200
OK dcm
s.amazon-adsystem.com/ Frame B4B3 43 B
855 B 198ms
84ms Image
image/gif 98.82.158.241
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

98.82.158.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Referer: https://eus.rubiconproject.com/

Response headers

Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 01 Jan 1970 00:00:00 GMT
x-amz-rid: JJ7XZAJ1XXK1N731SFD8
Content-Length: 43
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Date: Thu, 12 Jun 2025 02:04:16 GMT
Content-Type: image/gif
Vary: Content-Type,Accept-Encoding,User-Agent
Server: Server

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B4B3
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Mjk5ZDg3NTE2ZmFiOWE1Y2YwZTkzMzk2ODUwZjgyMDA0YmJmZWNlMg

170 B
188 B

50ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=Mjk5ZDg3NTE2ZmFiOWE1Y2YwZTkzMzk2ODUwZjgyMDA0YmJmZWNlMg

Requested by

Host: paint.toys
URL: https://paint.toys/oil/

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS